# CVE-2019-3396: Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

- Exploited (CISA KEV): yes, added 2021-11-03, known ransomware use
- Published: 2019-03-25
- CVSS: 9.8 CRITICAL (v3.1)
- EPSS: 99.9% (100th percentile)
- CWE: CWE-22

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | Before feed history | — | — |
| Microsoft Azure | Rule published | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Before feed history | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | Before feed history | — | — |

### Microsoft Azure

- undated · listed · rule 99001003
  > Rule 99001003: Critical - 5 · 2 · Attempted Atlassian Confluence Widget Connector exploitation CVE-2019-3396
  Source: https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-drs
- undated · listed · rule 99001003
  > Rule 99001003: Critical - 5 · 2 · Attempted Atlassian Confluence Widget Connector exploitation CVE-2019-3396
  Source: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: blocked (1 of 1 requests blocked), template CVE-2019-3396, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: blocked (1 of 1 requests blocked), template CVE-2019-3396, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2019-3396 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2019-3396