Lucene search
Security-metrics-botATLASSIAN:CONFSERVER-57971HistoryFeb 27, 2019 - 10:52 p.m.
SSRF via WebDAV endpoint - CVE-2019-3395
2019-02-2722:52:13
security-metrics-bot
jira.atlassian.com
437
0.974 High
EPSS
Percentile
99.9%
There was an SSRF vulnerability in Confluence Server and Data Center in the WebDAV plugin. A remote attacker is able to exploit this issue to send arbitrary HTTP and WebDAV requests from a Confluence Server instance.
Affected versions:
- All versions of Confluence Server and Confluence Data Center before version 6.6.7, from version 6.7.0 before 6.8.5 (the fixed version for 6.8.x), from version 6.9.0 before 6.9.3 (the fixed version for 6.9.x).
Fix:
- Confluence Server version 6.15.1 is available for download from [https://www.atlassian.com/software/confluence/download].
- Confluence Server version 6.14.2 is available for download from [https://www.atlassian.com/software/confluence/download-archives].
- Confluence Server version 6.13.3 is available for download from [https://www.atlassian.com/software/confluence/download-archives].
- Confluence Server version 6.12.3 is available for download from [https://www.atlassian.com/software/confluence/download-archives].
- Confluence Server version 6.6.12 is available for download from [https://www.atlassian.com/software/confluence/download-archives].
For additional details, see the full advisory: [https://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+-+2019-03-20]
Related
nessus
nessus
atlassian
atlassian
Remote code execution via Widget Connector macro - CVE-2019-3396
2019-02-28 03:02:04
Remote code execution via Widget Connector macro - CVE-2019-3396
2019-02-28 03:02:04
SSRF via WebDAV endpoint - CVE-2019-3395
2019-02-27 22:52:13
nvd
nvd
CVE-2019-3395
2019-03-25 19:29:01
CVE-2019-3396
2019-03-25 19:29:01
cvelist
cvelist
CVE-2019-3395
2019-03-20 00:00:00
CVE-2019-3396
2019-03-20 00:00:00
cve
cve
CVE-2019-3395
2019-03-25 19:29:01
CVE-2019-3396
2019-03-25 19:29:01
prion
prion
Server side request forgery (ssrf)
2019-03-25 19:29:00
Path traversal
2019-03-25 19:29:00
githubexploit
githubexploit
Exploit for Path Traversal in Atlassian Confluence
2019-04-09 06:20:51
Exploit for Path Traversal in Atlassian Confluence
2019-04-10 02:22:24
Exploit for Path Traversal in Atlassian Confluence
2019-04-10 02:15:47
trendmicroblog
trendmicroblog
This Week in Security News: Skimming Attacks and Ransomware
2019-05-10 13:00:42
This Week in Security News: BEC Attacks and Botnet Malware
2019-05-03 14:00:25
dsquare
dsquare
Confluence File Disclosure
2019-03-28 00:00:00
hackerone
hackerone
Mail.ru: Path traversal, SSTI and RCE on a MailRu acquisition
2019-04-11 20:10:37
Mail.ru: RCE on shared.mail.ru due to "widget" plugin
2019-03-29 10:45:58
packetstorm
packetstorm
Atlassian Confluence 6.12.1 Template Injection
2021-01-22 00:00:00
Atlassian Confluence Widget Connector Macro Velocity Template Injection
2019-04-18 00:00:00
securelist
securelist
MATA: Multi-platform targeted malware framework
2020-07-22 10:00:57
threatpost
threatpost
Lazarus Group Surfaces with Advanced Malware Framework
2020-07-22 16:43:44
Hezbollah-Linked Lebanese Cedar APT Infiltrates Hundreds of Servers
2021-02-01 21:18:09
Bug Parade: NSA Warns on Cresting China-Backed Cyberattacks
2020-10-21 20:31:17
attackerkb
attackerkb
CVE-2019-3396
2019-10-30 00:00:00
Confluence Unauthorized RCE Vulnerability
2019-03-25 00:00:00
zdt
zdt
canvas
canvas
Immunity Canvas: CONFLUENCE_MACRO_LFI
2019-03-25 19:29:00
cisa_kev
cisa_kev
fireeye
fireeye
GAME OVER: Detecting and Stopping an APT41 Operation
2019-08-19 00:00:00
checkpoint_advisories
checkpoint_advisories
Atlassian Confluence and Data Center Remote Code Execution (CVE-2019-3396)
2019-04-14 00:00:00
metasploit
metasploit
Atlassian Confluence Widget Connector Macro Velocity Template Injection
2019-04-11 12:55:51
nuclei
nuclei
Atlassian Confluence Server - Path Traversal
2020-07-07 07:24:27
exploitdb
exploitdb
Atlassian Confluence Widget Connector Macro - Velocity Template Injection (Metasploit)
2019-04-19 00:00:00
Atlassian Confluence Widget Connector Macro - SSTI
2021-01-22 00:00:00
thn
thn
Hezbollah Hacker Group Targeted Telecoms, Hosting, ISPs Worldwide
2021-01-29 10:08:00
Top 30 Critical Security Vulnerabilities Most Exploited by Hackers
2021-07-29 08:21:00
qualysblog
qualysblog
Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking
2019-12-27 18:01:22
NSA Alert: Chinese State-Sponsored Actors Exploit Known Vulnerabilities
2020-10-22 23:10:29
ics
ics
Top Routinely Exploited Vulnerabilities
2021-08-20 12:00:00
Potential for China Cyber Response to Heightened U.S.–China Tensions
2020-10-20 12:00:00