CVE-2019-20406

{"containers": {"cna": {"affected": [{"product": "Confluence Data Center", "vendor": "Atlassian", "versions": [{"lessThan": "7.0.5", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "7.1.0", "versionType": "custom"}, {"lessThan": "7.1.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2020-02-05T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability."}], "problemTypes": [{"descriptions": [{"description": "DLL Hijacking", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-02-06T03:10:28.000Z", "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://jira.atlassian.com/browse/CONFSERVER-59428"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@atlassian.com", "DATE_PUBLIC": "2020-02-05T00:00:00", "ID": "CVE-2019-20406", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Confluence Data Center", "version": {"version_data": [{"version_affected": "<", "version_value": "7.0.5"}, {"version_affected": ">=", "version_value": "7.1.0"}, {"version_affected": "<", "version_value": "7.1.1"}]}}]}, "vendor_name": "Atlassian"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "DLL Hijacking"}]}]}, "references": {"reference_data": [{"name": "https://jira.atlassian.com/browse/CONFSERVER-59428", "refsource": "MISC", "url": "https://jira.atlassian.com/browse/CONFSERVER-59428"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T02:39:09.888Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://jira.atlassian.com/browse/CONFSERVER-59428"}]}]}, "cveMetadata": {"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "assignerShortName": "atlassian", "cveId": "CVE-2019-20406", "datePublished": "2020-02-06T03:10:28.891Z", "dateReserved": "2020-01-23T00:00:00.000Z", "dateUpdated": "2024-09-16T23:21:49.035Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Confluence Data Center", "vendor": "Atlassian", "versions": [{"lessThan": "7.0.5", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "7.1.0", "versionType": "custom"}, {"lessThan": "7.1.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "security@atlassian.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*", "matchCriteriaId": "EF65FA07-82ED-457A-B57B-40E6BF0E7DDC", "versionEndExcluding": "7.0.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:7.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "9B15CD7E-BA60-416B-BF95-A4789ABA7F97", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability."}, {"lang": "es", "value": "El uso de Tomcat en Confluence en el sistema operativo Microsoft Windows antes de la versi\u00f3n 7.0.5 y desde la versi\u00f3n 7.1.0 antes de la versi\u00f3n 7.1.1, permite a atacantes del sistema local, que tienen permiso para escribir un archivo DLL en un directorio en la variable de entorno global path, inyectar c\u00f3digo y escalar sus privilegios por medio de una vulnerabilidad de secuestro de DLL."}], "id": "CVE-2019-20406", "lastModified": "2026-06-17T02:30:22.780", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-02-06T03:15:10.747", "references": [{"source": "security@atlassian.com", "tags": ["Vendor Advisory"], "url": "https://jira.atlassian.com/browse/CONFSERVER-59428"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://jira.atlassian.com/browse/CONFSERVER-59428"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}