CVE-2018-20237

MEDIUM severity · CVSS 6.5 · CWE-668

6.5CVSS MEDIUM

Summary

Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted page via the word export feature.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

Confidentiality impactHigh

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)0%

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products we track (1)

Atlassian Confluence

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://jira.atlassian.com/browse/CONFSERVER-57814Advisory
https://jira.atlassian.com/browse/CONFSERVER-57814Advisory
http://www.securityfocus.com/bid/107041Advisory
https://www.excellium-services.com/cert-xlm-advisory/cve-2018-20237/Advisory
http://www.securityfocus.com/bid/107041Advisory
https://www.excellium-services.com/cert-xlm-advisory/cve-2018-20237/Advisory