Privilege escalation via Tomcat DLL search path

DLL hijacking in Atlassian Confluence Data Center before 7.0.5 and 7.1.0 allows local users to execute code with elevated privileges. The bundled Tomcat service searches the global PATH for a DLL and loads an attacker-written library from a writable directory before a trusted copy. Exploitation requires local access, permission to place a DLL in a PATH directory, and user interaction that starts or restarts the service; successful loading executes the library in the service context.