CVE-2019-3395

9.8 criticalEPSS 6.7%

Critical (9.8) in atlassian. EPSS 6.7% chance of exploitation in the next 30 days.

The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fixed version for 6.8.x), and from version 6.9.0 before 6.9.3 (the fixed version for 6.9.x) allows remote attackers to send arbitrary HTTP and WebDAV requests from a Confluence Server or Data Center instance via Server-Side Request Forgery.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 6.7% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2019-03-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:confluence
atlassian:confluence_server

References

https://jira.atlassian.com/browse/CONFSERVER-57971
https://jira.atlassian.com/browse/CONFSERVER-57971

Check your stack JSON