CVE-2019-3396
Published: Mar 25, 2019
Modified: Oct 21, 2025
Description
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.
| Vendor | Product | Versions |
|---|---|---|
Atlassian | Confluence Server | affected unspecified - < 6.6.12affected 6.7.0 - < unspecifiedaffected unspecified - < 6.12.3affected next of 6.13.0 - < unspecifiedaffected unspecified - < 6.13.3+2 more versions |
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now