{"id":"CVE-2019-3396","kind":"vulnerability","aliases":["CVE-2019-3396"],"related":[],"title":"Atlassian Confluence Server and Data Server: Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability","description":"The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.","summary":"Atlassian Confluence Server and Data Center has a server-side template injection flaw in its Widget Connector macro that lets an attacker traverse paths and run code on the server. CISA lists it as actively exploited in the wild, and it has been tied to ransomware campaigns.","severity":"critical","cvss":10.0,"epss":0.99913,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Atlassian Confluence Server and Data Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["atlassian","confluence","exploited","java","package","ransomware","self-hosted"],"not_affected_if":["atlassian-cloud","unaffected-version"],"how_to_check":"Check the installed Confluence version under Administration > System Information or the footer of the admin pages; compare against the fixed release in the Atlassian advisory.","fix":"Upgrade Confluence Server or Data Center to a fixed version per Atlassian's security advisory for CVE-2019-3396.","status":"open","published_at":"2019-03-25T19:29:01+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:33:54+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:33:54Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Confluence Server or Data Center to a fixed version per Atlassian's security advisory for CVE-2019-3396.\nunknown","reach":"internet","impact":"high","summary":"Atlassian Confluence Server and Data Center has a server-side template injection flaw in its Widget Connector macro that lets an attacker traverse paths and run code on the server. CISA lists it as actively exploited in the wild, and it has been tied to ransomware campaigns.","category":"package","who_cares":["confluence","self-hosted","atlassian","java"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code on the Confluence server and reads its files and secrets.","analyst_note":"Get the affected and fixed version ranges and the Widget Connector workaround from the Atlassian advisory for CVE-2019-3396; sources given here do not list them.","how_to_check":"Check the installed Confluence version under Administration > System Information or the footer of the admin pages; compare against the fixed release in the Atlassian advisory.\nunknown","needs_analyst":true,"not_affected_if":["atlassian-cloud","unaffected-version"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000505,"input_tokens":2862,"output_tokens":438,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2019':20A,23A '-3396':21A,24A '6.12':114C '6.12.3':109C '6.13':125C '6.13.0':118C '6.13.3':120C '6.14':137C '6.14.0':130C '6.14.2':132C '6.6':103C '6.6.12':98C '6.7.0':107C 'achiev':143C 'activ':75B 'allow':139C 'and':28A 'atlassian':1A,7A,25A,31B,40B,93C 'attack':62B,141C 'campaign':87B 'center':12A,45B,156C 'cisa':71B 'code':67B,148C 'confluenc':2A,8A,32B,41B,94C,152C 'confluence':26A 'connector':57B,90C 'cve':19A,22A 'data':5A,11A,29A,44B,155C 'execut':149C 'exploit':33B,76B 'fix':100C,111C,122C,134C 'flaw':53B 'host':39B 'inject':17A,52B,163C 'instanc':157C 'java':34B 'let':60B 'list':72B 'macro':58B,91C 'packag':35B 'path':64B,144C 'ransomwar':36B,86B 'remot':140C,147C 'run':66B 'self':38B 'self-host':37B 'server':3A,6A,9A,14A,27A,30A,42B,49B,70B,95C,153C,160C 'server-sid':13A,48B,159C 'side':15A,50B,161C 'templat':16A,51B,162C 'tie':84B 'travers':63B,145C 'version':97C,101C,106C,112C,117C,123C,129C,135C 'via':158C 'vulner':18A 'widget':56B,89C 'wild':79B 'x':104C,115C,126C,138C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-03-25T19:29:01+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-3396","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-3396","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2019-3396","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-3396","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-3396","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3396","severity":null,"published_at":"2019-03-25T19:29:01+00:00","modified_at":"2026-06-17T02:35:05+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}