{"id":"CVE-2020-29448","state":"PUBLISHED","title":"The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowe","description":"The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.","publishedAt":"2021-02-18T15:08:59.028Z","updatedAt":"2024-09-17T02:31:11.206Z","severity":null,"assigner":"atlassian","products":["Atlassian Confluence Server","Atlassian Confluence Data Center"],"affected":[{"vendor":"Atlassian","product":"Confluence Server","versions":[{"version":"unspecified","status":"affected","lessThan":"6.13.18","versionType":"custom"},{"version":"6.14.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.4.6","versionType":"custom"},{"version":"7.5.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.8.3","versionType":"custom"}]},{"vendor":"Atlassian","product":"Confluence Data Center","versions":[{"version":"unspecified","status":"affected","lessThan":"6.13.18","versionType":"custom"},{"version":"6.14.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.4.6","versionType":"custom"},{"version":"7.5.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.8.3","versionType":"custom"}]}],"references":["https://jira.atlassian.com/browse/CONFSERVER-60469"],"weaknesses":[],"ingestedAt":"2026-10-29T19:47:16.535Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/29xxx/CVE-2020-29448.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-29448","state":"PUBLISHED","datePublished":"2021-02-18T15:08:59.028Z","dateUpdated":"2024-09-17T02:31:11.206Z","assignerShortName":"atlassian","assignerOrgId":"f08a6ab8-ed46-4c22-8884-d911ccfe3c66","dateReserved":"2020-12-01T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check."}],"affected":[{"vendor":"Atlassian","product":"Confluence Server","versions":[{"version":"unspecified","status":"affected","lessThan":"6.13.18","versionType":"custom"},{"version":"6.14.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.4.6","versionType":"custom"},{"version":"7.5.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.8.3","versionType":"custom"}]},{"vendor":"Atlassian","product":"Confluence Data Center","versions":[{"version":"unspecified","status":"affected","lessThan":"6.13.18","versionType":"custom"},{"version":"6.14.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.4.6","versionType":"custom"},{"version":"7.5.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.8.3","versionType":"custom"}]}],"references":[{"url":"https://jira.atlassian.com/browse/CONFSERVER-60469","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"description":"Arbitrary File Read","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"atlassian","dateUpdated":"2021-02-18T15:08:59.000Z","orgId":"f08a6ab8-ed46-4c22-8884-d911ccfe3c66"},"datePublic":"2020-11-10T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@atlassian.com","DATE_PUBLIC":"2020-11-10T12:03:00","ID":"CVE-2020-29448","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Confluence Server","version":{"version_data":[{"version_affected":"<","version_value":"6.13.18"},{"version_affected":">=","version_value":"6.14.0"},{"version_affected":"<","version_value":"7.4.6"},{"version_affected":">=","version_value":"7.5.0"},{"version_affected":"<","version_value":"7.8.3"}]}},{"product_name":"Confluence Data Center","version":{"version_data":[{"version_affected":"<","version_value":"6.13.18"},{"version_affected":">=","version_value":"6.14.0"},{"version_affected":"<","version_value":"7.4.6"},{"version_affected":">=","version_value":"7.5.0"},{"version_affected":"<","version_value":"7.8.3"}]}}]},"vendor_name":"Atlassian"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Arbitrary File Read"}]}]},"references":{"reference_data":[{"name":"https://jira.atlassian.com/browse/CONFSERVER-60469","refsource":"MISC","url":"https://jira.atlassian.com/browse/CONFSERVER-60469"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://jira.atlassian.com/browse/CONFSERVER-60469","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T16:55:09.777Z"}}]}}}