cnvd - cnvd-2019-08178

cnvd-2019-08178

Vulnerability from cnvd

Title: Atlassian Confluence Server和Atlassian Data Center服务器端请求伪造漏洞

Description:

Atlassian Confluence Server和Atlassian Data Center都是澳大利亚Atlassian公司的产品。Atlassian Confluence Server是一套专业的企业知识管理与协同软件，也可以用于构建企业WiKi。Atlassian Data Center是一套数据中心系统。

Atlassian Confluence Server和Atlassian Data Center 6.6.7之前版本、6.7.0版本至6.8.5之前版本和6.9.0版本至6.9.3之前版本中的WebDAV端点存在服务器端请求伪造漏洞。远程攻击者可利用该漏洞凭借Confluence Server或Data Center实例发送任意HTTP和WebDAV请求。

Severity: 中

Patch Name: Atlassian Confluence Server和Atlassian Data Center服务器端请求伪造漏洞的补丁

Patch Description:

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://jira.atlassian.com/browse/CONFSERVER-57971

Reference: https://jira.atlassian.com/browse/CONFSERVER-57971 http://seclists.org/bugtraq/2019/Mar/40

Impacted products

Name
['Atlassian Confluence Server <6.6.7', 'Atlassian Confluence Server >=6.7.0，<=6.8.5', 'Atlassian Confluence Server >=6.9.0，<=6.9.3', 'Atlassian Data Center <6.6.7', 'Atlassian Data Center >=6.7.0，<=6.8.5', 'Atlassian Data Center >=6.9.0，<=6.9.3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-3395"
    }
  },
  "description": "Atlassian Confluence Server\u548cAtlassian Data Center\u90fd\u662f\u6fb3\u5927\u5229\u4e9aAtlassian\u516c\u53f8\u7684\u4ea7\u54c1\u3002Atlassian Confluence Server\u662f\u4e00\u5957\u4e13\u4e1a\u7684\u4f01\u4e1a\u77e5\u8bc6\u7ba1\u7406\u4e0e\u534f\u540c\u8f6f\u4ef6\uff0c\u4e5f\u53ef\u4ee5\u7528\u4e8e\u6784\u5efa\u4f01\u4e1aWiKi\u3002Atlassian Data Center\u662f\u4e00\u5957\u6570\u636e\u4e2d\u5fc3\u7cfb\u7edf\u3002\n\nAtlassian Confluence Server\u548cAtlassian Data Center 6.6.7\u4e4b\u524d\u7248\u672c\u30016.7.0\u7248\u672c\u81f36.8.5\u4e4b\u524d\u7248\u672c\u548c6.9.0\u7248\u672c\u81f36.9.3\u4e4b\u524d\u7248\u672c\u4e2d\u7684WebDAV\u7aef\u70b9\u5b58\u5728\u670d\u52a1\u5668\u7aef\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u51ed\u501fConfluence Server\u6216Data Center\u5b9e\u4f8b\u53d1\u9001\u4efb\u610fHTTP\u548cWebDAV\u8bf7\u6c42\u3002",
  "discovererName": "unknwon",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://jira.atlassian.com/browse/CONFSERVER-57971",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-08178",
  "openTime": "2019-03-26",
  "patchDescription": "Atlassian Confluence Server\u548cAtlassian Data Center\u90fd\u662f\u6fb3\u5927\u5229\u4e9aAtlassian\u516c\u53f8\u7684\u4ea7\u54c1\u3002Atlassian Confluence Server\u662f\u4e00\u5957\u4e13\u4e1a\u7684\u4f01\u4e1a\u77e5\u8bc6\u7ba1\u7406\u4e0e\u534f\u540c\u8f6f\u4ef6\uff0c\u4e5f\u53ef\u4ee5\u7528\u4e8e\u6784\u5efa\u4f01\u4e1aWiKi\u3002Atlassian Data Center\u662f\u4e00\u5957\u6570\u636e\u4e2d\u5fc3\u7cfb\u7edf\u3002\r\n\r\nAtlassian Confluence Server\u548cAtlassian Data Center 6.6.7\u4e4b\u524d\u7248\u672c\u30016.7.0\u7248\u672c\u81f36.8.5\u4e4b\u524d\u7248\u672c\u548c6.9.0\u7248\u672c\u81f36.9.3\u4e4b\u524d\u7248\u672c\u4e2d\u7684WebDAV\u7aef\u70b9\u5b58\u5728\u670d\u52a1\u5668\u7aef\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u51ed\u501fConfluence Server\u6216Data Center\u5b9e\u4f8b\u53d1\u9001\u4efb\u610fHTTP\u548cWebDAV\u8bf7\u6c42\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Atlassian Confluence Server\u548cAtlassian Data Center\u670d\u52a1\u5668\u7aef\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Atlassian Confluence Server \u003c6.6.7",
      "Atlassian Confluence Server \u003e=6.7.0\uff0c\u003c=6.8.5",
      "Atlassian Confluence Server \u003e=6.9.0\uff0c\u003c=6.9.3",
      "Atlassian Data Center \u003c6.6.7",
      "Atlassian Data Center \u003e=6.7.0\uff0c\u003c=6.8.5",
      "Atlassian Data Center \u003e=6.9.0\uff0c\u003c=6.9.3"
    ]
  },
  "referenceLink": "https://jira.atlassian.com/browse/CONFSERVER-57971\r\nhttp://seclists.org/bugtraq/2019/Mar/40",
  "serverity": "\u4e2d",
  "submitTime": "2019-03-26",
  "title": "Atlassian Confluence Server\u548cAtlassian Data Center\u670d\u52a1\u5668\u7aef\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e"
}

CVE-2019-3395 (GCVE-0-2019-3395)

Vulnerability from cvelistv5

Published

2019-03-25 18:37

Modified

2024-09-17 00:20

Severity ?

CWE

Server-Side Request Forgery (SSRF)

Summary

The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fixed version for 6.8.x), and from version 6.9.0 before 6.9.3 (the fixed version for 6.9.x) allows remote attackers to send arbitrary HTTP and WebDAV requests from a Confluence Server or Data Center instance via Server-Side Request Forgery.

References

▼	URL	Tags
	https://jira.atlassian.com/browse/CONFSERVER-57971	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Atlassian	Confluence Server	Version: unspecified < 6.6.7 Version: 6.7.0 < unspecified Version: unspecified < Version: 6.8.0 < unspecified Version: unspecified < 6.8.5 Version: 6.9.0 < unspecified Version: unspecified < 6.9.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:12:08.548Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/CONFSERVER-57971"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Confluence Server",
          "vendor": "Atlassian",
          "versions": [
            {
              "lessThan": "6.6.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.7.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.7.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.8.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.9.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2019-03-20T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fixed version for 6.8.x), and from version 6.9.0 before 6.9.3 (the fixed version for 6.9.x) allows remote attackers to send arbitrary HTTP and WebDAV requests from a Confluence Server or Data Center instance via Server-Side Request Forgery."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-03-25T18:37:06",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.atlassian.com/browse/CONFSERVER-57971"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@atlassian.com",
          "DATE_PUBLIC": "2019-03-20T10:00:00",
          "ID": "CVE-2019-3395",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Confluence Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.6.7"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.7.0"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "6.7.3"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.8.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.8.5"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.9.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.9.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Atlassian"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fixed version for 6.8.x), and from version 6.9.0 before 6.9.3 (the fixed version for 6.9.x) allows remote attackers to send arbitrary HTTP and WebDAV requests from a Confluence Server or Data Center instance via Server-Side Request Forgery."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Server-Side Request Forgery (SSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.atlassian.com/browse/CONFSERVER-57971",
              "refsource": "MISC",
              "url": "https://jira.atlassian.com/browse/CONFSERVER-57971"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2019-3395",
    "datePublished": "2019-03-25T18:37:06.217310Z",
    "dateReserved": "2018-12-19T00:00:00",
    "dateUpdated": "2024-09-17T00:20:30.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted