CVEvulnerability

CVE-2020-29448

5.3 MEDIUM Published 2021-02-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-02-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N

Description

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

Affected configurations

• atlassian confluence data center (< 6.13.18) • atlassian confluence data center (>= 6.14.0 < 7.4.6) • atlassian confluence data center (>= 7.5.0 < 7.8.3) • atlassian confluence server (< 6.13.18) • atlassian confluence server (>= 6.14.0 < 7.4.6) • atlassian confluence server (>= 7.5.0 < 7.8.3)

References