CVE-2020-29448

5.3 mediumEPSS 2.6%

Medium (5.3) in atlassian. EPSS 2.6% chance of exploitation in the next 30 days.

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
Published: 2021-02-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:confluence_data_center
atlassian:confluence_server

References

https://jira.atlassian.com/browse/CONFSERVER-60469
https://jira.atlassian.com/browse/CONFSERVER-60469

Check your stack JSON