CVE-2020-29453

CVE-2020-29453: vulnerability in Atlassian Jira Server

Published · Updated

23Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 24%
exploitation probability
24%top 2% of all CVEs
observed exploitation
nono source reports it
The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.
Affected products
Atlassian · Jira Data CenterAtlassian · Jira Server
Related CVEs — Atlassian Jira Server

In the same product, most dangerous first.

CVE-2021-26086MEDIUMCVE-2021-26086EPSS 100.0%KEVCVE-2020-14181—CVE-2020-14181EPSS 99.6%CVE-2020-36289MEDIUMCVE-2020-36289EPSS 99.2%CVE-2020-14179—CVE-2020-14179EPSS 76.0%CVE-2022-36801MEDIUMCVE-2022-36801EPSS 66.3%CVE-2021-43942—CVE-2021-43942EPSS 55.4%
References
https://jira.atlassian.com/browse/JRASERVER-72014