10

CVE-2019-3396: Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

KEVRansomware
Analyzed
Published 25-03-2019Last modified 21-10-2025

Vulnerability summary

CVE-2019-3396 is a high (CVSS 10.0) vulnerability in Atlassian Confluence Server and Data Server. It is known to be exploited: CISA lists it, first on 03-11-2021. It has been used in ransomware campaigns. EPSS estimates a 99.91% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 6 public exploits are recorded.

Priority
Act nowransomware

Known ransomware use (CISA, 03-11-2021)

Source freshness unavailable

How is this decided?
CVSS score
10.0/10
010
High · v2.0 (NVD)
EPSS score
99.91%
0%100%
Critical · 0.00 pp in 30 days
KEVExploited in the wildCritical · listed in 1 catalog
RansomwareKnown useFlagged by CISA
Public exploits6reference, exploit-database, metasploit

Timeline

  1. 25-03-2019
    PublishedVulnerability first disclosed.
  2. 03-11-2021
    Added to CISA KEVExploitedAtlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability
  3. 03-05-2022
    CISA remediation dueDeadline passedApply updates per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

99.91%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 99.91% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
03-11-2021
Federal due date
03-05-2022
Ransomware
ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2019-3396

Public exploits

6 found
  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (rapid7.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

Show all 6 exploits
  • exploit-databaseremotemultipleVerified

    Atlassian Confluence Widget Connector Macro - Velocity Template Injection (Metasploit)

    Maturity: weaponized

  • exploit-databasemultipleUnverified

    Atlassian Confluence Widget Connector Macro - SSTI

    Maturity: poc

  • MetasploitMetasploitremoteVerified

    Atlassian Confluence Widget Connector Macro Velocity Template Injection

    exploit/multi/http/confluence_widget_connector

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Atlassian1 product
  • confluence_server≥ unspecified, < 6.6.12 | ≥ 6.7.0, < unspecified | ≥ unspecified, < 6.12.3 | ≥ next of 6.13.0, < unspecified | ≥ unspecified, < 6.13.3 | ≥ next of 6.14.0, < unspecified | ≥ unspecified, < 6.14.2 | < 6.6.12 | ≥ 6.7.0, < 6.12.3 | ≥ 6.13.0, < 6.13.3 | ≥ 6.14.0, < 6.14.2

1 vendor · 1 product

References

6 links