What’s Vulnerable › Vulnerabilities

CVE-2019-3396: Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 99.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-03-25 · updated 2026-06-17
• Weakness: CWE-22

Description

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

Affected products

• Atlassian Confluence Data Center: before 6.6.12; from 6.7.0 before 6.12.3; from 6.13.0 before 6.13.3; from 6.14.0 before 6.14.2 — fixed in 6.12.3, 6.13.3, 6.14.2, 6.6.12

How to fix

Upgrade to a fixed version: Atlassian Confluence Data Center 6.12.3, 6.13.3, 6.14.2, 6.6.12. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.html
• http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injection.html
• http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connector
• https://jira.atlassian.com/browse/CONFSERVER-57974
• https://www.exploit-db.com/exploits/46731/
• http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.html
• http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injection.html
• http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connector
• https://jira.atlassian.com/browse/CONFSERVER-57974
• https://www.exploit-db.com/exploits/46731/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3396

Get alerted when CVE-2019-3396 or the next vulnerability affects your stack