CVE-2020-29448
En bref Sévérité Non disponible EPSS EPSS 2.58 % · centile 85 (2026-10-27) État PUBLISHED Publiée 2021-02-18 Mise à jour 2024-09-17 Attribuée par atlassian Statut NVD Modified Description The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N NVD · nvd@nist.gov (Primary) CVSS 2.0 MEDIUM 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N NVD · nvd@nist.gov (Primary)
Références européennes
Configurations affectées (CPE NVD) cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* < 6.13.18cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 6.14.0 < 7.4.6cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 7.5.0 < 7.8.3cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* < 6.13.18cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 6.14.0 < 7.4.6cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.5.0 < 7.8.3Produits affectés Produit Versions Atlassian · Confluence Server affected unspecified < 6.13.18 ; affected 6.14.0 < unspecified ; affected unspecified < 7.4.6 ; affected 7.5.0 < unspecified ; affected unspecified < 7.8.3 Atlassian · Confluence Data Center affected unspecified < 6.13.18 ; affected 6.14.0 < unspecified ; affected unspecified < 7.4.6 ; affected 7.5.0 < unspecified ; affected unspecified < 7.8.3
Références
Sources
