Path Traversal Vulnerability in Confluence Server and Data Center by Atlassian
CVE-2020-29448

5.3MEDIUM

Key Information:

Vendor

Atlassian
Status
Confluence Server
Confluence Data Center
Vendor
CVE Published:
22 February 2021

What is CVE-2020-29448?

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Data Center versions prior to 6.13.18 and specific versions from 6.14.0 to 7.8.3 contains a vulnerability that enables remote attackers to read sensitive files within the WEB-INF and META-INF directories. This issue arises from an inadequate path access check, allowing unauthorized access to crucial application resources.

Affected Version(s)

Confluence Data Center < 6.13.18

Confluence Data Center 6.14.0

Confluence Data Center < 7.4.6

References

https://jira.atlassian.com/browse/CONFSERVER-60469
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.