CVE-2019-15006

{"id": "CVE-2019-15006", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.2}]}, "published": "2019-12-19T01:15:10.600", "references": [{"url": "http://packetstormsecurity.com/files/155742/Atlassian-Confluence-Man-In-The-Middle.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@atlassian.com"}, {"url": "https://confluence.atlassian.com/doc/confluence-security-advisory-2019-12-18-982324349.html", "tags": ["Patch", "Vendor Advisory"], "source": "security@atlassian.com"}, {"url": "https://jira.atlassian.com/browse/CONFSERVER-59244", "tags": ["Patch", "Vendor Advisory"], "source": "security@atlassian.com"}, {"url": "https://seclists.org/bugtraq/2019/Dec/36", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@atlassian.com"}, {"url": "https://twitter.com/SwiftOnSecurity/status/1202034106495832067", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "security@atlassian.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-913"}]}], "descriptions": [{"lang": "en", "value": "There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the Atlassian Companion application. The Confluence Previews plugin in Confluence Server and Confluence Data Center communicated with the Companion application via the atlassian-domain-for-localhost-connections-only.com domain name, the DNS A record of which points at 127.0.0.1. Additionally, a signed certificate for the domain was publicly distributed with the Companion application. An attacker in the position to control DNS resolution of their victim could carry out a man-in-the-middle (MITM) attack between Confluence Server (or Confluence Data Center) and the atlassian-domain-for-localhost-connections-only.com domain intended to be used with the Companion application. This certificate has been revoked, however, usage of the atlassian-domain-for-localhost-connections-only.com domain name was still present in Confluence Server and Confluence Data Center. An attacker could perform the described attack by denying their victim access to certificate revocation information, and carry out a man-in-the-middle (MITM) attack to observe files being edited using the Companion application and/or modify them, and access some limited user information."}, {"lang": "es", "value": "Hab\u00eda una vulnerabilidad de tipo man-in-the-middle (MITM) presente en el plugin Confluence Previews en Confluence Server y Confluence Data Center. Este plugin se utiliz\u00f3 para facilitar la comunicaci\u00f3n con la aplicaci\u00f3n Atlassian Companion. El plugin Confluence Previews en Confluence Server y Confluence Data Center se comunic\u00f3 con la aplicaci\u00f3n Companion por medio del nombre de dominio atlassian-domain-for-localhost-connections-only.com, cuyo registro DNS A se\u00f1ala en versi\u00f3n 127.0.0.1. Adem\u00e1s, un certificado firmado para el dominio se distribuy\u00f3 p\u00fablicamente con la aplicaci\u00f3n Companion. Un atacante en posici\u00f3n de controlar la resoluci\u00f3n DNS de su v\u00edctima podr\u00eda llevar a cabo un ataque de tipo man-in-the-middle (MITM) entre Confluence Server (o Confluence Data Center) y el dominio atlassian-domain-for-localhost-connections-only.com destinado a ser utilizado con la aplicaci\u00f3n Companion. Este certificado ha sido revocado, sin embargo, el uso del nombre de dominio atlassian-domain-for-localhost-connections-only.com todav\u00eda estaba presente en Confluence Server y Confluence Data Center. Un atacante podr\u00eda realizar el ataque descrito mediante la negaci\u00f3n a sus v\u00edctimas del acceso a la informaci\u00f3n de revocaci\u00f3n de certificados, y llevar a cabo un ataque de tipo man-in-the-middle (MITM) para observar los archivos que est\u00e1n siendo editados usando la aplicaci\u00f3n Companion y/o modificarlos, y acceder a alguna Informaci\u00f3n del usuario limitada."}], "lastModified": "2021-12-13T16:05:55.590", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8E6BB7A-08EA-4B5B-9041-4A64933F233D", "versionEndExcluding": "6.13.10", "versionStartIncluding": "6.11.0"}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47031E70-1E35-427F-9489-499089F4E8B4", "versionEndExcluding": "6.15.10", "versionStartIncluding": "6.14.0"}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2DDF811-196E-4711-B8ED-2169DC2EFB17", "versionEndExcluding": "7.0.5", "versionStartIncluding": "7.0.1"}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9695D285-429A-4236-B3B8-FDF60D86BF2C", "versionEndExcluding": "7.1.2", "versionStartIncluding": "7.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@atlassian.com"}