Every CVE Search/ Get API key

CVE-2019-3396

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed...

9.8 CriticalIn KEVPublic exploit

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.9%Up 51.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

Record
CVE-2019-3396
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-22
Updated
2026-11-02
CVE List 9.8

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

Record
CVE-2019-3396
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2019-13035 9.8

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

Record
EUVD-2019-13035
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-fr34-8fhg-2m6q 9.8

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed...

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

Record
GHSA-fr34-8fhg-2m6q
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
CISA KEV No score

Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.

Record
CVE-2019-3396
Weakness
CWE-22
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitAtlassian Confluence Widget Connector Macro Velocity Template Injection2019-03-25
PoC in GitHubdothanthitiendiettiende/CVE-2019-33962019-04-09
PoC in GitHubx-f1v3/CVE-2019-33962019-04-09
PoC in GitHubxiaoshuier/CVE-2019-33962019-04-09
PoC in GitHubYt1g3r/CVE-2019-3396_EXP2019-04-10
PoC in GitHubjas502n/CVE-2019-33962019-04-10
PoC in GitHubpyn3rd/CVE-2019-33962019-04-10
PoC in GitHubquanpt103/CVE-2019-33962019-04-10
PoC in GitHubs1xg0d/CVE-2019-33962019-04-10
Exploit-DBAtlassian Confluence Widget Connector Macro - Velocity Template Injection (Metasploit)2019-04-19
Show 16 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubvntest11/confluence_CVE-2019-33962019-04-28
PoC in GitHubtanw923/test12019-07-01
PoC in GitHubskommando/CVE-2019-3396-confluence-poc2019-08-21
PoC in GitHubJonathanZhou348/CVE-2019-3396TEST2019-10-28
PoC in GitHubam6539/CVE-2019-33962019-11-21
PoC in GitHubW2Ning/CVE-2019-33962019-12-12
PoC in GitHubyuehanked/cve-2019-33962020-11-17
Exploit-DBAtlassian Confluence Widget Connector Macro - SSTI2021-01-22
PoC in GitHub0xNinjaCyclone/cve-2019-33962021-02-01
PoC in GitHub46o60/CVE-2019-3396_Confluence2021-02-05
PoC in GitHubPetrusViet/cve-2019-33962021-05-01
PoC in GitHubAvento/CVE-2019-3396-Memshell-for-Behinder2024-05-21
PoC in GitHubtranphuc2005/CVE-2019-33962025-08-30
PoC in GitHubkh4sh3i/CVE-2019-33962025-09-16
PoC in GitHubtno01/cve-2019-33962025-09-30
NucleiAtlassian Confluence Server - Path Traversal

History

History
RecordedChangedSources
exploitation
exploits
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-3396 is a critical vulnerability (CVSS 9.8) in Atlassian Confluence Server, published March 25, 2019. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.9%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open