CVE-2020-29448

—

CVSS 3.1

5.3 medium

EPSS

3%p84

Published

Feb 22, 2021 (Feb 22, 2021)

Modified

Jun 17, 2026

Description

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

Vendors: atlassian
Products: confluence data center, confluence server
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (2.6%)

In the news0 stories

No ingested article mentions this CVE yet.