Lucene search

[email protected]CVE-2020-29448

HistoryFeb 22, 2021 - 9:15 p.m.

CVE-2020-29448

2021-02-2221:15:00

NVD-CWE-noinfo

[email protected]

web.nvd.nist.gov

cve-2020-29448

confluence

server

data center

remote attack

arbitrary file access

path access check

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.5 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

55.8%

JSON

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

CPENameOperatorVersion
atlassian:confluence_serveratlassian confluence serverlt6.13.18
atlassian:confluence_serveratlassian confluence serverlt7.4.6
atlassian:confluence_serveratlassian confluence serverlt7.8.3
atlassian:confluence_data_centeratlassian confluence data centerlt6.13.18
atlassian:confluence_data_centeratlassian confluence data centerlt7.4.6
atlassian:confluence_data_centeratlassian confluence data centerlt7.8.3

CPE	Name	Operator	Version
atlassian:confluence_server	atlassian confluence server	lt	6.13.18
atlassian:confluence_server	atlassian confluence server	lt	7.4.6
atlassian:confluence_server	atlassian confluence server	lt	7.8.3
atlassian:confluence_data_center	atlassian confluence data center	lt	6.13.18
atlassian:confluence_data_center	atlassian confluence data center	lt	7.4.6
atlassian:confluence_data_center	atlassian confluence data center	lt	7.8.3

References

jira.atlassian.com/browse/CONFSERVER-60469

Social References

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.5 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

55.8%

JSON

Related for CVE-2020-29448

prion1 nessus1 atlassian8