CVE-2020-29453
medium · 5.3A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.
5.3
CVSS
23.9%
EPSS (exploit prob.)
98th
EPSS percentile
2021-02-22
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| atlassian | data_center | >= 8.5.10, < 8.5.11 |
| atlassian | data_center | >= 8.6.0, < 8.13.3 |
| atlassian | jira_data_center | >= 8.14.0, < 8.15.0 |
| atlassian | jira_server | >= 8.5.10, < 8.5.11 |
| atlassian | jira_server | >= 8.6.0, < 8.13.3 |
| atlassian | jira_server | >= 8.14.0, < 8.15.0 |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2020-29453