CVE-2020-29445

MEDIUM severity · CVSS 4.3 · Server-side request forgery (SSRF)

4.3CVSS MEDIUM

Summary

Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify internal hosts and ports via a blind server-side request forgery vulnerability in Team Calendars parameters.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

Confidentiality impactLow

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)0%

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products we track (1)

Atlassian Confluence

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://jira.atlassian.com/browse/CONFSERVER-61453Advisory
https://jira.atlassian.com/browse/CONFSERVER-61453Advisory