CVE-2020-36240

5.3 mediumEPSS 1.3%

Medium (5.3) in atlassian crowd. EPSS 1.3% chance of exploitation in the next 30 days.

The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
Published: 2021-03-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:crowd

References

https://jira.atlassian.com/browse/CWD-5685
https://jira.atlassian.com/browse/CWD-5685

Check your stack JSON