How severe is CVE-2020-29448?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Atlassian Confluence Data Center

CVE-2020-29448

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

EPSS: 0.023 (81.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Atlassian Confluence Data Center — versions unspecified, 6.14.0, 7.5.0
Atlassian Confluence_data_center
Atlassian Confluence Server — versions unspecified, 6.14.0, 7.5.0
Atlassian Confluence_server

References

security@atlassian.com (Patch, x_refsource_MISC, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2020-29448?: CVE-2020-29448 is a medium-severity vulnerability in Atlassian Confluence Data Center. CVSS score: 5.3/10. Published 2021-02-22.
How severe is CVE-2020-29448?: Medium severity. CVSS v3 base score is 5.3 out of 10.