Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

概要

参考情報

• packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.html · Exploit
• packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injection.html · Exploit
• rapid7.com/db/modules/exploit/multi/http/confluence_widget_connector · Exploit
• jira.atlassian.com/browse/CONFSERVER-57974 · Issue Tracking
• exploit-db.com/exploits/46731 · Exploit
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2019-3396

confluence server のその他の脆弱性

• CVE-2025-22166高 7.5This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Ser…
• CVE-2024-21703中 6.4This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Window…
• CVE-2024-21690高 8.2This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0…
• CVE-2024-21686高 8.7This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This Stored XSS vulnerabi…
• CVE-2024-21683高 8.8This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (…