CVE-2019-20406: 
Confluence Server vulnerability analysis and mitigation

CVE-2019-20406 affects Confluence running on Microsoft Windows operating systems. The vulnerability was discovered in versions before 7.0.5 and versions 7.1.0 before 7.1.1, with the disclosure date being February 4, 2020. The issue is related to the usage of Tomcat in Confluence on Windows systems (Atlassian Jira).

The vulnerability is a DLL hijacking issue that exists in the Tomcat component of Confluence when running on Microsoft Windows operating systems. The security flaw allows local system attackers with permissions to write a DLL file in a directory within the global path environmental variable to perform code injection (Atlassian Jira).

The vulnerability enables local attackers to potentially escalate their privileges through DLL hijacking, affecting the security of Confluence installations on Windows systems (Atlassian Jira).

The vulnerability has been fixed in Confluence versions 7.0.5 and 7.1.1. Users should upgrade to these or later versions to mitigate the security risk (Atlassian Jira).

The vulnerability was responsibly disclosed by Peleg Hadar of SafeBreach Labs, who was acknowledged by Atlassian for reporting this security issue (Atlassian Jira).