CVE-2020-29453

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:24

Type Values Removed Values Added
References () https://jira.atlassian.com/browse/JRASERVER-72014 - Vendor Advisory () https://jira.atlassian.com/browse/JRASERVER-72014 - Vendor Advisory

Information

Published : 2021-02-22 21:15

Updated : 2024-11-21 05:24


NVD link : CVE-2020-29453

Mitre link : CVE-2020-29453

CVE.ORG link : CVE-2020-29453


JSON object : View

Products Affected

atlassian

  • data_center
  • jira_data_center
  • jira_server
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')