According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.6.12, 6.7.x prior to 6.12.3, 6.13.x prior to 6.13.3, or 6.14.x prior to 6.14.2. It is, therefore, affected by the following vulnerabilities :

  - A server-side request forgery (SSRF) exists in the     WebDAV plugin due to improper input validation. An     attacker can exploit this, via unspecified vectors, to     send arbitrary HTTP and WebDAV requests from the     application. (CVE-2019-3395)

  - A server-side template injection exists in the Widget     Connector due to improper input validation. An attacker     can exploit this, via unspecified vectors, to traverse     directories or execute arbitrary code. (CVE-2019-3396)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Atlassian Confluence < 6.6.12 / 6.7.x < 6.12.3 / 6.13.x < 6.13.3 / 6.14.x < 6.14.2 Multiple Vulnerabilities

critical Nessus Plugin ID 123008

Version 1.14

Version 1.13

Version 1.14 Jun 5, 2024, 10:55 AM Required Scan configuration ("Enable cgi scanning" set to "True") Plugin Feed: 202406051055
Version 1.13 Dec 6, 2022, 2:54 AM Reference Plugin Feed: 202212060254