CVE-2020-29448 — Atlassian Confluence Data Center vulnerability

3 documents3 sources
Severity
5.3MEDIUMNVD
EPSS
0.6%
top 29.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Atlassian Confluence Data CenterAtlassian Confluence Server
Timeline
PublishedFeb 22
Latest updateMay 24

Description

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶CVEListV5atlassian/confluence_data_centerunspecified — 6.13.18+4
▶NVDatlassian/confluence_data_center6.14.0 — 7.4.6+2
▶CVEListV5atlassian/confluence_serverunspecified — 6.13.18+4
▶NVDatlassian/confluence_server6.14.0 — 7.4.6+2

Patches

Patch: jira.atlassian.com ↗Patch: jira.atlassian.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-98cv-g579-8fm6: The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6↗2022-05-24
▶
CVEList
CVE-2020-29448: The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6↗2021-02-18
▶
CVE-2020-29448 — Atlassian vulnerability | cvebase