Atlassian Confluence vulnerabilities

19 CVEs affecting Atlassian Confluence, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-4027, published 2020-07-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-2926, published 2012-05-22. Critical severity, CVSS 9.1. EPSS: 66.3% chance of exploitation in the next 30 days. Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and…
CVE-2015-8399, published 2016-04-11. Medium severity, CVSS 4.3. EPSS: 60.2% chance of exploitation in the next 30 days. Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2)…
CVE-2019-3394, published 2019-08-29. High severity, CVSS 8.8. EPSS: 11% chance of exploitation in the next 30 days. There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An attacker with permission to editing a page is able to exploit this issue to read…
CVE-2019-3395, published 2019-03-25. Critical severity, CVSS 9.8. EPSS: 6.7% chance of exploitation in the next 30 days. The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fixed version for 6.8.x), and from version…
CVE-2016-6283, published 2017-01-18. Medium severity, CVSS 6.1. EPSS: 3.2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.10.6 allows remote attackers to inject arbitrary web script or HTML via the newFileName parameter to…
CVE-2015-8398, published 2016-04-11. Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to rest/prototype/1/session/check.
CVE-2019-15006, published 2019-12-19. Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days. There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the…
CVE-2020-4027, published 2020-07-01. Medium severity, CVSS 4.7. EPSS: 1.5% chance of exploitation in the next 30 days. Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection…
CVE-2019-15005, published 2019-11-08. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to…
CVE-2017-9505, published 2017-06-15. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to…

Latest

CVE-2019-20406, published 2020-02-06. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to…
CVE-2018-13389, published 2018-07-10. Medium severity, CVSS 4.7. EPSS: 1% chance of exploitation in the next 30 days. The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attachments that have a content-type of…
CVE-2017-18086, published 2018-02-02. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the issuesURL…
CVE-2017-18085, published 2018-02-02. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability…
CVE-2017-18084, published 2018-02-02. Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days. The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the…