CVE-2020-29448

MEDIUM severity · CVSS 5.3

5.3CVSS MEDIUM

Summary

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactLow

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)1%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products we track (1)

Atlassian Confluence

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Official patch: https://jira.atlassian.com/browse/CONFSERVER-60469 ↗

Additional information

NVD record
https://jira.atlassian.com/browse/CONFSERVER-60469Patch
https://jira.atlassian.com/browse/CONFSERVER-60469Patch