CVE-2020-29448
The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF…
Does this matter?
Lower severity and a low EPSS score (2.58%). Track it; it rarely justifies an emergency change on its own.
Description
The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 2.58% probability · 84th percentile
- CISA KEV
- Not listed
- Affected
- atlassian/confluence data center · atlassian/confluence server
- Source
- security@atlassian.com
References
- https://jira.atlassian.com/browse/CONFSERVER-60469Issue Tracking, Patch, Vendor Advisory
- https://jira.atlassian.com/browse/CONFSERVER-60469Issue Tracking, Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.