CVE-2020-29453

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
AtlassianJira Server>= unspecified, < 8.5.11; >= 8.6.0, < unspecified; >= unspecified, < 8.13.3; >= 8.14.0, < unspecified; >= unspecified, < 8.15.0
AtlassianJira Data Center>= unspecified, < 8.5.11; >= 8.6.0, < unspecified; >= unspecified, < 8.13.3; >= 8.14.0, < unspecified; >= unspecified, < 8.15.0

References

Timeline

Published
Feb 22, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-294544.3Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings CVE-2020-294556.1A cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows CVE-2020-294566.1Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTMLCVE-2020-294574.4A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connectiCVE-2020-294588.8Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem.CVE-2020-29466.0Vulnerability in the Application Performance Management product of Oracle Enterprise Manager (component: EM Request Monitoring). Supported vCVE-2020-294695.4WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. This vulnerability can allow an attacker to inject the XSS CVE-2020-29474.3Vulnerability in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft (component: Absence Management). The supporteCVE-2020-294704.8OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject CVE-2020-294714.8OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code usiCVE-2020-294729.8EGavilan Media Under Construction page with cPanel 1.0 contains a SQL injection vulnerability. An attacker can gain Admin Panel access usingCVE-2020-294749.8EGavilan Media EGM Address Book 1.0 contains a SQL injection vulnerability. An attacker can gain Admin Panel access using malicious SQL inje
CVE-2020-29453: Medium severity, CVSS 5.3 | Vulnix