« Volver al listado

CVE-2019-15006

Estado: ModificadaMedia (6.5)—

There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the Atlassian Companion application. The Confluence Previews plugin in Confluence Server and Confluence Data Center communicated with the Companion application via the atlassian-domain-for-localhost-connections-only.com domain name, the DNS A record of which points at 127.0.0.1. Additionally, a signed certificate for the domain was publicly distributed with the Companion application.

Leer descripción completaMostrar menos

An attacker in the position to control DNS resolution of their victim could carry out a man-in-the-middle (MITM) attack between Confluence Server (or Confluence Data Center) and the atlassian-domain-for-localhost-connections-only.com domain intended to be used with the Companion application. This certificate has been revoked, however, usage of the atlassian-domain-for-localhost-connections-only.com domain name was still present in Confluence Server and Confluence Data Center. An attacker could perform the described attack by denying their victim access to certificate revocation information, and carry out a man-in-the-middle (MITM) attack to observe files being edited using the Companion application and/or modify them, and access some limited user information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Atlassian — ConfluenceAtlassian — Confluence Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-15006",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@atlassian.com",
      "affectedData": [
        {
          "vendor": "Atlassian",
          "product": "Confluence Server",
          "versions": [
            {
              "status": "affected",
              "version": "6.11.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "6.13.10",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.14.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "6.15.10",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.0.1",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "7.0.5",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.1.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "7.1.2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.2.0-beta1",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "7.2.0",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-12-19T01:15:10.600",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/155742/Atlassian-Confluence-Man-In-The-Middle.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://confluence.atlassian.com/doc/confluence-security-advisory-2019-12-18-982324349.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://jira.atlassian.com/browse/CONFSERVER-59244",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://seclists.org/bugtraq/2019/Dec/36",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://twitter.com/SwiftOnSecurity/status/1202034106495832067",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/155742/Atlassian-Confluence-Man-In-The-Middle.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://confluence.atlassian.com/doc/confluence-security-advisory-2019-12-18-982324349.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jira.atlassian.com/browse/CONFSERVER-59244",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://seclists.org/bugtraq/2019/Dec/36",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://twitter.com/SwiftOnSecurity/status/1202034106495832067",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-913"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the Atlassian Companion application. The Confluence Previews plugin in Confluence Server and Confluence Data Center communicated with the Companion application via the atlassian-domain-for-localhost-connections-only.com domain name, the DNS A record of which points at 127.0.0.1. Additionally, a signed certificate for the domain was publicly distributed with the Companion application. An attacker in the position to control DNS resolution of their victim could carry out a man-in-the-middle (MITM) attack between Confluence Server (or Confluence Data Center) and the atlassian-domain-for-localhost-connections-only.com domain intended to be used with the Companion application. This certificate has been revoked, however, usage of the atlassian-domain-for-localhost-connections-only.com domain name was still present in Confluence Server and Confluence Data Center. An attacker could perform the described attack by denying their victim access to certificate revocation information, and carry out a man-in-the-middle (MITM) attack to observe files being edited using the Companion application and/or modify them, and access some limited user information."
    },
    {
      "lang": "es",
      "value": "Había una vulnerabilidad de tipo man-in-the-middle (MITM) presente en el plugin Confluence Previews en Confluence Server y Confluence Data Center. Este plugin se utilizó para facilitar la comunicación con la aplicación Atlassian Companion. El plugin Confluence Previews en Confluence Server y Confluence Data Center se comunicó con la aplicación Companion por medio del nombre de dominio atlassian-domain-for-localhost-connections-only.com, cuyo registro DNS A señala en versión 127.0.0.1. Además, un certificado firmado para el dominio se distribuyó públicamente con la aplicación Companion. Un atacante en posición de controlar la resolución DNS de su víctima podría llevar a cabo un ataque de tipo man-in-the-middle (MITM) entre Confluence Server (o Confluence Data Center) y el dominio atlassian-domain-for-localhost-connections-only.com destinado a ser utilizado con la aplicación Companion. Este certificado ha sido revocado, sin embargo, el uso del nombre de dominio atlassian-domain-for-localhost-connections-only.com todavía estaba presente en Confluence Server y Confluence Data Center. Un atacante podría realizar el ataque descrito mediante la negación a sus víctimas del acceso a la información de revocación de certificados, y llevar a cabo un ataque de tipo man-in-the-middle (MITM) para observar los archivos que están siendo editados usando la aplicación Companion y/o modificarlos, y acceder a alguna Información del usuario limitada."
    }
  ],
  "lastModified": "2026-06-17T02:19:29.530",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8E6BB7A-08EA-4B5B-9041-4A64933F233D",
              "versionEndExcluding": "6.13.10",
              "versionStartIncluding": "6.11.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47031E70-1E35-427F-9489-499089F4E8B4",
              "versionEndExcluding": "6.15.10",
              "versionStartIncluding": "6.14.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B2DDF811-196E-4711-B8ED-2169DC2EFB17",
              "versionEndExcluding": "7.0.5",
              "versionStartIncluding": "7.0.1"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9695D285-429A-4236-B3B8-FDF60D86BF2C",
              "versionEndExcluding": "7.1.2",
              "versionStartIncluding": "7.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@atlassian.com"
}