CVE-2019-3398

What Is Atlassian Confluence?

Confluence is Atlassian's team collaboration and wiki platform, used to host internal documentation, project plans, and knowledge bases across enterprises and government agencies. Its file attachment features handle user-uploaded content on the server filesystem, making path handling bugs in these features a direct route to writing files outside intended directories.

Overview

CVE-2019-3398 is a path traversal vulnerability (CWE-22) in Confluence Server and Data Center's downloadallattachments resource, which allows an authenticated, privileged remote attacker to write files to arbitrary locations on the server filesystem. With a CVSS score of 8.8, the practical impact is severe: writing a file to a web-accessible directory (such as a JSP file inside Confluence's own web application) can be leveraged to achieve remote code execution.

Technical Details

The downloadallattachments feature packages a page's attachments for bulk download; the vulnerable code path fails to properly sanitize a filename or path parameter associated with this functionality, allowing directory traversal sequences (../) to redirect the resulting file write outside the intended attachments storage directory. An attacker with a low-privileged Confluence account (e.g., basic edit/attach permissions) can exploit this to plant a file — such as a JSP web shell — into a location the web server will execute, converting a file-write primitive into full remote code execution.

Because authentication is required (Privileges Required: Low in the CVSS vector), this vulnerability typically follows some form of account access, whether through valid low-privilege credentials, an open self-registration feature, or a separate authentication bypass.

Discovery

Atlassian disclosed and patched this vulnerability through its own security advisory process in April 2019, alongside other Confluence hardening fixes released around the same period.

Exploitation Context

CISA's KEV listing confirms this vulnerability has been exploited in the wild. It has frequently been discussed alongside CVE-2019-3396 (the related unauthenticated Widget Connector SSTI bug) as part of the broader wave of Confluence exploitation throughout 2019–2021; environments that allow open user self-registration or have weak account controls are especially exposed, since the "authenticated" bar for this bug can be trivially cleared by attackers who register their own account.

Remediation

1. Upgrade Confluence Server/Data Center to a patched version per Atlassian's April 2019 advisory or later.
2. Disable open user self-registration on Confluence instances where it is not operationally required, to raise the bar for reaching authenticated-only vulnerabilities like this one.
3. Restrict and audit account permissions, ensuring low-privileged users cannot reach administrative or file-management functionality unnecessarily.
4. Review Confluence attachment directories and web-accessible paths for unexpected files (e.g., JSP web shells) that may indicate prior exploitation.
5. Combine with mitigations for CVE-2019-3396, since both vulnerabilities were exploited in the same general timeframe against internet-exposed Confluence instances.