CVE-2020-29453

5.3 mediumEPSS 20%

Medium (5.3) in atlassian. EPSS 20% chance of exploitation in the next 30 days.

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 20% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2021-02-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:data_center
atlassian:jira_data_center
atlassian:jira_server

References

https://jira.atlassian.com/browse/JRASERVER-72014
https://jira.atlassian.com/browse/JRASERVER-72014

Check your stack JSON