CVE Database · CVE-2019-3396
CVSS v3.1
9.8
EPSS
99.91%
Published
Mar 25, 2019
Modified
Oct 24, 2025
CISA Known Exploited Vulnerability
Added: 2021-11-03 · Due: 2022-05-03
Apply updates per vendor instructions.
Public PoC / Exploit (12)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses (CWE)
Affected Products (4)
References (11)