CVE-2019-20406

The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability.

CVSS v3 7.8 HIGH
CVSS v2.0 4.4 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 3.4 / Impact : 6.4

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://jira.atlassian.com/browse/CONFSERVER-59428	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:atlassian:confluence::::::::
	cpe:2.3:a:atlassian:confluence_server:7.1.0:::::::*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

13 Dec 2021, 16:05

Type	Values Removed	Values Added
CPE	cpe:2.3:a:atlassian:confluence:7.1.0:::::::*	cpe:2.3:a:atlassian:confluence_server:7.1.0:::::::*
CWE	~~CWE-426~~	CWE-427

Information

Published : 2020-02-06 03:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-20406

Mitre link : CVE-2019-20406

CVE.ORG link : CVE-2019-20406

JSON object : View

Products Affected

atlassian

confluence
confluence_server

microsoft

windows

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2019-20406", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-02-06T03:15:10.747", "references": [{"url": "https://jira.atlassian.com/browse/CONFSERVER-59428", "tags": ["Vendor Advisory"], "source": "security@atlassian.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability."}, {"lang": "es", "value": "El uso de Tomcat en Confluence en el sistema operativo Microsoft Windows antes de la versi\u00f3n 7.0.5 y desde la versi\u00f3n 7.1.0 antes de la versi\u00f3n 7.1.1, permite a atacantes del sistema local, que tienen permiso para escribir un archivo DLL en un directorio en la variable de entorno global path, inyectar c\u00f3digo y escalar sus privilegios por medio de una vulnerabilidad de secuestro de DLL."}], "lastModified": "2021-12-13T16:05:55.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF65FA07-82ED-457A-B57B-40E6BF0E7DDC", "versionEndExcluding": "7.0.5"}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:7.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B15CD7E-BA60-416B-BF95-A4789ABA7F97"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@atlassian.com"}