CVE-2020-29448

Name of the Vulnerable Software and Affected Versions: Confluence Server versions prior to 6.13.18 Confluence Server versions 6.14.0 through 7.4.5 Confluence Server versions 7.5.0 through 7.8.2 Confluence Data Center versions prior to 6.13.18 Confluence Data Center versions 6.14.0 through 7.4.5 Confluence Data Center versions 7.5.0 through 7.8.2

Description: The issue allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. This was due to a problem in the ConfluenceResourceDownloadRewriteRule class.

Recommendations: For Confluence Server versions prior to 6.13.18, update to version 6.13.18 or later. For Confluence Server versions 6.14.0 through 7.4.5, update to version 7.4.6 or later. For Confluence Server versions 7.5.0 through 7.8.2, update to version 7.8.3 or later. For Confluence Data Center versions prior to 6.13.18, update to version 6.13.18 or later. For Confluence Data Center versions 6.14.0 through 7.4.5, update to version 7.4.6 or later. For Confluence Data Center versions 7.5.0 through 7.8.2, update to version 7.8.3 or later.