According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.6.12, 6.7.x prior to 6.12.3, 6.13.x prior to 6.13.3, or 6.14.x prior to 6.14.2. It is, therefore, affected by the following vulnerabilities :

 - A server-side request forgery (SSRF) exists in the WebDAV plugin due to improper input validation. An attacker can exploit this, via unspecified vectors, to send arbitrary HTTP and WebDAV requests from the application. (CVE-2019-3395)

 - A server-side template injection exists in the Widget Connector due to improper input validation. An attacker can exploit this, via unspecified vectors, to traverse directories or execute arbitrary code. (CVE-2019-3396)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12, 6.7.0 < 6.12.3, 6.13.0 < 6.13.3 and 6.14.0 < 6.14.2 allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

This vulnerability has been verified using a remote check and should be remediated immediately.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.6.12, 6.7.x prior to 6.12.3, 6.13.x prior to 6.13.3, or 6.14.x prior to 6.14.2. It is, therefore, affected by the following vulnerabilities :

  - A server-side request forgery (SSRF) exists in the     WebDAV plugin due to improper input validation. An     attacker can exploit this, via unspecified vectors, to     send arbitrary HTTP and WebDAV requests from the     application. (CVE-2019-3395)

  - A server-side template injection exists in the Widget     Connector due to improper input validation. An attacker     can exploit this, via unspecified vectors, to traverse     directories or execute arbitrary code. (CVE-2019-3396)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the tests performed by Nessus, the remote host is affected by the following vulnerability:

  - A server-side template injection exists in the Widget     Connector due to improper input validation. An attacker     can exploit this, via unspecified vectors, to traverse     directories or execute arbitrary code. (CVE-2019-3396)

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.6.12, 6.7.x prior to 6.12.3, 6.13.x prior to 6.13.3, or 6.14.x prior to 6.14.2. It is, therefore, affected by the following vulnerabilities:

 - A server-side request forgery (SSRF) exists in the WebDAV plugin due to improper input validation. An attacker can exploit this, via unspecified vectors, to send arbitrary HTTP and WebDAV requests from the application. (CVE-2019-3395)
 - A server-side template injection exists in the Widget Connector due to improper input validation. An attacker can exploit this, via unspecified vectors, to traverse directories or execute arbitrary code. (CVE-2019-3396)

ID	Name	Product	Family	Published	Updated	Severity
98640	Atlassian Confluence 6.7.x < 6.12.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/17/2019	3/14/2023	critical
98638	Atlassian Confluence 6.14.x < 6.14.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/17/2019	3/14/2023	critical
98641	Atlassian Confluence < 6.6.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/17/2019	3/14/2023	critical
98639	Atlassian Confluence 6.13.x < 6.13.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/17/2019	3/14/2023	critical
98613	Atlassian Confluence < 6.6.12 / 6.7.x < 6.12.3 / 6.13.x < 6.13.3 / 6.14.x < 6.14.2 Template Injection	Web App Scanning	Component Vulnerability	5/30/2019	9/7/2021	critical
123008	Atlassian Confluence < 6.6.12 / 6.7.x < 6.12.3 / 6.13.x < 6.13.3 / 6.14.x < 6.14.2 Multiple Vulnerabilities	Nessus	CGI abuses	3/22/2019	6/5/2024	critical
124004	Atlassian Confluence < 6.6.12 / 6.7.x < 6.12.3 / 6.13.x < 6.13.3 / 6.14.x < 6.14.2 Template Injection	Nessus	CGI abuses	4/11/2019	6/5/2024	critical
700661	Atlassian Confluence < 6.6.12 / 6.7.x < 6.12.3 / 6.13.x < 6.13.3 / 6.14.x < 6.14.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	5/2/2019	5/2/2019	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical