CVE-2020-29448

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
Atlassian	Confluence Server	>= unspecified, < 6.13.18; >= 6.14.0, < unspecified; >= unspecified, < 7.4.6; >= 7.5.0, < unspecified; >= unspecified, < 7.8.3
Atlassian	Confluence Data Center	>= unspecified, < 6.13.18; >= 6.14.0, < unspecified; >= unspecified, < 7.4.6; >= 7.5.0, < unspecified; >= unspecified, < 7.8.3

References

https://jira.atlassian.com/browse/CONFSERVER-60469Issue Tracking, Patch, Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-60469Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Feb 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-29457.1Vulnerability in the Oracle Financial Services Deposit Insurance Calculations for Liquidity Risk Management product of Oracle Financial Serv CVE-2020-294506.5Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denia CVE-2020-294514.3Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure v CVE-2020-294535.3The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8 CVE-2020-294544.3Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings CVE-2020-294556.1A cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows CVE-2020-294566.1Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML CVE-2020-294574.4A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connecti CVE-2020-294588.8Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem.CVE-2020-29466.0Vulnerability in the Application Performance Management product of Oracle Enterprise Manager (component: EM Request Monitoring). Supported v CVE-2020-294695.4WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. This vulnerability can allow an attacker to inject the XSS CVE-2020-29474.3Vulnerability in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft (component: Absence Management). The supporte