CVE-2019-15006

There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the Atlassian Companion application. The Confluence Previews plugin in Confluence Server and Confluence Data Center communicated with the Companion application via the atlassian-domain-for-localhost-connections-only.com domain name, the DNS A record of which points at 127.0.0.1. Additionally, a signed certificate for the domain was publicly distributed with the Companion application. An attacker in the position to control DNS resolution of their victim could carry out a man-in-the-middle (MITM) attack between Confluence Server (or Confluence Data Center) and the atlassian-domain-for-localhost-connections-only.com domain intended to be used with the Companion application. This certificate has been revoked, however, usage of the atlassian-domain-for-localhost-connections-only.com domain name was still present in Confluence Server and Confluence Data Center. An attacker could perform the described attack by denying their victim access to certificate revocation information, and carry out a man-in-the-middle (MITM) attack to observe files being edited using the Companion application and/or modify them, and access some limited user information.

• CWE-913

• http://packetstormsecurity.com/files/155742/Atlassian-Confluence-Man-In-The-Middle.htmlThird Party Advisory, VDB Entry
• https://confluence.atlassian.com/doc/confluence-security-advisory-2019-12-18-982324349.htmlPatch, Vendor Advisory
• https://jira.atlassian.com/browse/CONFSERVER-59244Patch, Vendor Advisory
• https://seclists.org/bugtraq/2019/Dec/36Mailing List, Third Party Advisory
• https://twitter.com/SwiftOnSecurity/status/1202034106495832067Issue Tracking, Third Party Advisory
• http://packetstormsecurity.com/files/155742/Atlassian-Confluence-Man-In-The-Middle.htmlThird Party Advisory, VDB Entry
• https://confluence.atlassian.com/doc/confluence-security-advisory-2019-12-18-982324349.htmlPatch, Vendor Advisory
• https://jira.atlassian.com/browse/CONFSERVER-59244Patch, Vendor Advisory
• https://seclists.org/bugtraq/2019/Dec/36Mailing List, Third Party Advisory
• https://twitter.com/SwiftOnSecurity/status/1202034106495832067Issue Tracking, Third Party Advisory

Published

Dec 19, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15000The commit diff rest endpoint in Bitbucket Server and Data C…9.8
• CVE-2019-15001The Jira Importers Plugin in Atlassian Jira Server and Data …7.2
• CVE-2019-15002An exploitable CSRF vulnerability exists in Atlassian Jira, …4.3
• CVE-2019-15003The Customer Context Filter in Atlassian Jira Service Desk S…5.3
• CVE-2019-15004The Customer Context Filter in Atlassian Jira Service Desk S…7.5
• CVE-2019-15005The Atlassian Troubleshooting and Support Tools plugin prior…4.3
• CVE-2019-15007The review resource in Atlassian Fisheye and Crucible before…4.8
• CVE-2019-15008The /plugins/servlet/branchreview resource in Atlassian Fish…6.1
• CVE-2019-15009The /json/profile/removeStarAjax.do resource in Atlassian Fi…4.3
• CVE-2019-1501Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15010Bitbucket Server and Bitbucket Data Center versions starting…8.8
• CVE-2019-15011The ListEntityLinksServlet resource in Application Links bef…4.3