CVE-2020-36240

—

CVSS 3.1

5.3 medium

EPSS

1%p67

Published

Mar 1, 2021 (Mar 1, 2021)

Modified

Jun 17, 2026

Description

The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

Vendors: atlassian
Products: crowd
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news0 stories

No ingested article mentions this CVE yet.