CVE-2020-29448: The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated...

Summary

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
atlassian	confluence_data_center	< 6.13.18 >= 6.14.0, < 7.4.6 >= 7.5.0, < 7.8.3 `cpe:2.3:a:atlassian:confluence_data_center::::::::`
atlassian	confluence_server	< 6.13.18 >= 6.14.0, < 7.4.6 >= 7.5.0, < 7.8.3 `cpe:2.3:a:atlassian:confluence_server::::::::`

Original advisory text

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated...

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

References

https://jira.atlassian.com/browse/CONFSERVER-60469 Issue Tracking Patch Vendor Advisory