Description

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

Remediation

References

CVE-2020-29448

Related Vulnerabilities

WordPress Plugin Registrations for the Events Calendar-Event Registration Cross-Site Scripting (2.7.4)

WordPress Plugin Buddypress Component Stats Local File Inclusion (1.0)

Jboss EAP Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Vulnerability (CVE-2019-20444)

Liferay Portal CVE-2021-33330 Vulnerability (CVE-2021-33330)

Ruby on Rails Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-2694)

Severity

Medium

Classification

CVE-2020-29448 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities