---
title: "Confluence path traversal (CVE-2019-3398)"
canonical: https://trickest.com/library/cve-2019-3398-confluence-downloadallattachments-path-traversal
description: "Flag Atlassian Confluence hosts for CVE-2019-3398 by reading ajs-version-number on /login.action. Floors 6.6.13 through 6.15.2. No traversal."
---

# Confluence path traversal (CVE-2019-3398)

## Overview

This workflow finds Atlassian Confluence Server and Data Center and sorts each host by whether its version falls below the CVE-2019-3398 fixed floors. CVE-2019-3398 is path traversal in the downloadallattachments action that can expose files on vulnerable builds. This check never hits that action and never reads an attachment. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/login.action`, fingerprints the product from Confluence markers on that page, reads `ajs-version-number`, and compares that number to the per-branch table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). There is no authenticated exploit and no confirm step.

Run it on a schedule when wiki hosts turn over. A restored 6.x backup that lands below its branch floor is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/login.action` on each host and fingerprint Confluence from page markers such as `ajs-version-number`, `ajs-build-number`, and Confluence powered-by strings.
3. Parse the version from `ajs-version-number` and compare it to the CVE-2019-3398 per-branch floors in the graph.
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Confluence was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/login.action` only. No downloadallattachments request and no file read.

## Sample output

The records below are illustrative and do not come from a real run. They show one Confluence host below a CVE-2019-3398 floor, one at or above its branch floor, and one host that is not the product.

```jsonl
{"url": "https://wiki.example.com", "is_product": true, "product_version": "6.14.1", "vulnerable": true, "detail": "below branch floor 6.14.3"}
{"url": "https://wiki.example.org", "is_product": true, "product_version": "6.15.2", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Atlassian Confluence"}
```

```json
{"cve": "CVE-2019-3398", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Confluence versions does this flag?

Builds below the per-branch floors in the graph: 6.6.13, 6.12.4, 6.13.4, 6.14.3, and 6.15.2. A version picks the matching band, then compares to that band's floor. The compare uses the version Confluence itself served on `/login.action`.

### Does an affected row mean path traversal worked?

No. The check only GETs `/login.action` and reads `ajs-version-number`. It does not call downloadallattachments and it does not read a file.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of the public login page. It does not log in or traverse paths.

### Does the check need credentials?

No. It fingerprints the public login page the way an external scanner would. The underlying CVE may need auth to exploit; this workflow does not.

### What is CVE-2019-3398?

Path traversal in Atlassian Confluence Server and Data Center through the downloadallattachments action. This workflow maps hosts to that CVE by version exposure only.

## Related workflows

- [Confluence SSTI RCE (CVE-2019-3396)](/library/cve-2019-3396-confluence-widget-connector-ssti-rce). Reach for it when you need the companion Widget Connector fingerprint from the same era.
- [Confluence OGNL RCE (CVE-2021-26084)](/library/cve-2021-26084-confluence-ognl-injection-rce). Reach for it when the next Confluence flag is OGNL, not path traversal.
- [Confluence pre-auth file read (CVE-2021-26085)](/library/cve-2021-26085-confluence-pre-auth-file-read). Reach for it when you need the later pre-auth file-read version gate.

---
_Markdown source of https://trickest.com/library/cve-2019-3398-confluence-downloadallattachments-path-traversal._