CoreCVE
Back

MEDIUM

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check

Published Feb 18, 2021

Description

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner atlassian
Published Feb 18, 2021
Updated Sep 17, 2024
Reserved Dec 1, 2020
Link CVE-2020-29448
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2020-29448
Red Hat
Severity n/a
Public date n/a
Links CVE-2020-29448
ENISA EUVD
Assigner atlassian
Published Feb 18, 2021
Updated Sep 17, 2024
Exploited since n/a
Link EUVD-2020-21821
EUVD-2020-21821