Description
The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Atlassian | Jira Server | unspecified – < 8.5.11, 8.6.0 – < unspecified, unspecified – < 8.13.3, 8.14.0 – < unspecified, unspecified – < 8.15.0 | 8.5.11 |
| Atlassian | Jira Data Center | unspecified – < 8.5.11, 8.6.0 – < unspecified, unspecified – < 8.13.3, 8.14.0 – < unspecified, unspecified – < 8.15.0 | 8.5.11 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF) http/cves/2020/CVE-2020-29453.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.