CVE-2020-4027: Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template…

PriorityP426medium4.7CVSS 3.1

AVNACLPRHUINSUCLILAL

EPSS

1.52%

71.6th percentile

Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros. The affected versions are before version 7.4.5, and from version 7.5.0 before 7.5.1.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
atlassian	confluence	< 7.4.5	7.4.5
atlassian	confluence_data_center	>= 7.5.0 < unspecified	unspecified
atlassian	confluence_data_center	>= unspecified < 7.4.5	7.4.5
atlassian	confluence_data_center	>= unspecified < 7.5.1	7.5.1
atlassian	confluence_server	>= 7.5.0 < unspecified	unspecified
atlassian	confluence_server	>= 7.5.0 < 7.5.1	7.5.1
atlassian	confluence_server	>= unspecified < 7.4.5	7.4.5
atlassian	confluence_server	>= unspecified < 7.5.1	7.5.1

CVSS provenance

nvdv3.14.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.