{"id":"CVE-2019-3396","published":"2019-03-25T19:29:01Z","modified":"2026-06-17T02:35:05Z","title":"Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability","vendor":"Atlassian","product":"Confluence Server and Data Server","tier":"core","eol":null,"description":{"text":"The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.","provenance":"source","from":"NVD"},"summary":{"text":"The Widget Connector macro in Atlassian Confluence Server and Data Center contains a server-side template injection flaw in the affected version ranges, with the vulnerability sitting in that macro component. A remote attacker with no authentication and no user interaction, reaching the instance over the network, can achieve path traversal and remote code execution on the server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:23Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99913,"percentile":0.99967,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-3396","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-04-23","exploitedFirstSeen":"2019-04-23","ransomware":true,"evidence":[{"url":"https://www.alertlogic.com/blog/active-exploitation-of-confluence-vulnerability-cve-2019-3396-dropping-gandcrab-ransomware/","date":"2019-04-23"},{"url":"https://www.bleepingcomputer.com/news/security/vulnerable-confluence-servers-get-infected-with-ransomware-trojans/","date":"2019-04-26"},{"url":"https://www.tenable.com/blog/cve-2019-3396-vulnerability-in-atlassian-confluence-widget-connector-exploited-in-the-wild","date":"2019-04-30"},{"url":"https://digital.nhs.uk/cyber-alerts/2019/cc-3043","date":"2019-05-01"},{"url":"https://www.trendmicro.com/en_us/research/19/e/cve-2019-3396-redux-confluence-vulnerability-exploited-to-deliver-cryptocurrency-miner-with-rootkit.html","date":"2019-05-07"},{"url":"https://www.mandiant.com/resources/game-over-detecting-and-stopping-an-apt41-operation","date":"2019-08-19"},{"url":"https://web.archive.org/web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf","date":"2019-09-01"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities-exploits-and-malware-driving-attack-campaigns-in-november-2019","date":"2019-12-24"},{"url":"https://blog.sonicwall.com/en-us/2019/12/top-cves-exploited-in-the-wild-in-the-year-2019/","date":"2019-12-27"},{"url":"https://www.alibabacloud.com/blog/new-outbreak-of-h2miner-worms-exploiting-redis-rce-detected_595743","date":"2020-01-16"}],"evidenceTotal":997,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connector","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://jira.atlassian.com/browse/CONFSERVER-57974","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/46731/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connector","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://jira.atlassian.com/browse/CONFSERVER-57974","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/46731/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3396","tags":["US Government Resource"]}],"techniques":[{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other Injection","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2019-3396 is a critical server-side template injection vulnerability in Atlassian Confluence Server and Data Center that could lead to remote code execution. ","confidence":"high"},{"id":"T1090","name":"Proxy","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other Injection","mappingType":"primary_impact","evidence":[],"comment":"CVE-2019-3396 is a critical server-side template injection vulnerability in Atlassian Confluence Server and Data Center that could lead to remote code execution. ","confidence":"high"},{"id":"T1202","name":"Indirect Command Execution","tactics":["stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2019-3396 is a critical server-side template injection vulnerability in Atlassian Confluence Server and Data Center that could lead to remote code execution. ","confidence":"high"},{"id":"T1083","name":"File and Directory Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"}],"reports":[{"id":"SRC-f4c4ebd4090daa7d77ab","title":"____________________________________________________________________________________________________","publisher":"clearskysec.com","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf","date":null,"mentions":[{"quote":"Server CVE-2019-3396","start":15714,"end":15734},{"quote":"• Atlassian Confluence Server (CVE-2019-3396)","start":18442,"end":18487}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-13035","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13035","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":46731,"url":"https://www.exploit-db.com/exploits/46731","title":"Atlassian Confluence Widget Connector Macro - Velocity Template Injection (Metasploit)","type":"remote","platform":"multiple","date":"2019-04-19","verified":true,"provenance":"source"},{"id":46731,"url":"https://www.exploit-db.com/exploits/46731","title":"Atlassian Confluence Widget Connector Macro - Velocity Template Injection (Metasploit)","type":"remote","platform":"multiple","date":"2019-04-19","verified":true,"provenance":"source"},{"id":49465,"url":"https://www.exploit-db.com/exploits/49465","title":"Atlassian Confluence Widget Connector Macro - SSTI","type":"webapps","platform":"multiple","date":"2021-01-22","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2019-04-19"},"pocGithub":{"count":16,"skipped":6,"earliest":"2019-04-09","earliestUrl":"https://github.com/dothanthitiendiettiende/CVE-2019-3396","repos":[{"name":"Yt1g3r/CVE-2019-3396_EXP","url":"https://github.com/Yt1g3r/CVE-2019-3396_EXP","stars":174,"created":"2019-04-10"},{"name":"jas502n/CVE-2019-3396","url":"https://github.com/jas502n/CVE-2019-3396","stars":144,"created":"2019-04-10"},{"name":"pyn3rd/CVE-2019-3396","url":"https://github.com/pyn3rd/CVE-2019-3396","stars":39,"created":"2019-04-10"},{"name":"x-f1v3/CVE-2019-3396","url":"https://github.com/x-f1v3/CVE-2019-3396","stars":22,"created":"2019-04-09"},{"name":"0xNinjaCyclone/cve-2019-3396","url":"https://github.com/0xNinjaCyclone/cve-2019-3396","stars":3,"created":"2021-02-01"}]},"metasploit":[{"name":"Atlassian Confluence Widget Connector Macro Velocity Template Injection","module":"exploit/multi/http/confluence_widget_connector","type":"exploit","disclosureDate":"2019-03-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/confluence_widget_connector.rb"}],"nuclei":[{"id":"CVE-2019-3396","name":"Atlassian Confluence Server - Path Traversal","severity":"critical","path":"http/cves/2019/CVE-2019-3396.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3396.yaml"}],"first":{"date":"2019-03-25","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/confluence_widget_connector.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.html","http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injection.html","http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connector","https://www.exploit-db.com/exploits/46731/"],"flow":[{"stage":"exploitation","techniques":["T1133"],"provenance":"source"},{"stage":"primary","techniques":["T1090"],"provenance":"source"},{"stage":"secondary","techniques":["T1202"],"provenance":"source"},{"stage":"related","techniques":["T1190","T1203","T1083"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2019-03-25","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3396","provenance":"source"},{"date":"2019-03-25","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2019-04-09, Exploit-DB 2019-04-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/confluence_widget_connector.rb","provenance":"source"},{"date":"2019-04-23","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.alertlogic.com/blog/active-exploitation-of-confluence-vulnerability-cve-2019-3396-dropping-gandcrab-ransomware/","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13035","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":954},"priority":{"score":83.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2748 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"4 NVD references tagged Exploit; 3 Exploit-DB entries; 16 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}