# CVE-2019-3396: Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

Source: https://junglewise.ai/threats/cve-2019-3396-atlassian-confluence-server-and-data-center-server-side-template  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-11-03. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2019-3396 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2021-11-03

The Widget Connector macro in Atlassian Confluence Server and Data Center contains a server-side template injection vulnerability. Remote attackers can exploit this to achieve path traversal and remote code execution on the affected instance.

Technologies: [Atlassian Confluence Server](https://junglewise.ai/threats/technologies/confluence-server). Vendors: [Atlassian](https://junglewise.ai/threats/vendors/atlassian).

## Quick answers

**Is CVE-2019-3396 exploited in the wild?** Yes. CVE-2019-3396 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.

**How severe is CVE-2019-3396?** Critical severity, with a CVSS score of 9.8, published 3 November 2021.

**Which products and versions are affected?** Atlassian Confluence Server < 6.6.12, 6.7.0 to < 6.12.3, 6.13.0 to < 6.13.3, 6.14.0 to < 6.14.2; Atlassian Confluence Data Center < 6.6.12, 6.7.0 to < 6.12.3, 6.13.0 to < 6.13.3, 6.14.0 to < 6.14.2.

**Is there a fix for CVE-2019-3396?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-3396 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2019-3396?** Check whether you run Atlassian Confluence Server or Atlassian Data Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Atlassian Confluence Server < 6.6.12, 6.7.0 to < 6.12.3, 6.13.0 to < 6.13.3, 6.14.0 to < 6.14.2
- Atlassian Confluence Data Center < 6.6.12, 6.7.0 to < 6.12.3, 6.13.0 to < 6.13.3, 6.14.0 to < 6.14.2

## Timeline

- 2019-03-20: advisory: Initial vendor advisory (CONFSERVER-57974) published
- 2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2021-11-03: disclosed: NVD publication date

## Related threats

- [Atlassian Confluence Data Center and Server Template Injection Vulnerability](https://junglewise.ai/threats/cve-2023-22527-atlassian-confluence-data-center-and-server-template-injection)
- [Atlassian Confluence Data Center and Server Improper Authorization Vulnerability](https://junglewise.ai/threats/cve-2023-22518-atlassian-confluence-data-center-and-server-improper)
- [Atlassian Confluence Data Center and Server Broken Access Control Vulnerability](https://junglewise.ai/threats/cve-2023-22515-atlassian-confluence-data-center-and-server-broken-access-control)
- [Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2022-26134-atlassian-confluence-server-and-data-center-remote-code-execution)
- [Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability](https://junglewise.ai/threats/cve-2021-26085-atlassian-confluence-server-pre-authorization-arbitrary-file-read)