{"api_version":"1","generated_at":"2026-07-23T12:13:46+00:00","cve":"CVE-2020-29453","urls":{"html":"https://cve.report/CVE-2020-29453","api":"https://cve.report/api/cve/CVE-2020-29453.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-29453","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-29453"},"summary":{"title":"CVE-2020-29453","description":"The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.","state":"PUBLIC","assigner":"security@atlassian.com","published_at":"2021-02-22 21:15:00","updated_at":"2022-03-30 13:29:00"},"problem_types":["CWE-22"],"metrics":[],"references":[{"url":"https://jira.atlassian.com/browse/JRASERVER-72014","name":"https://jira.atlassian.com/browse/JRASERVER-72014","refsource":"MISC","tags":["Vendor Advisory"],"title":"[JRASERVER-72014] Pre-Authorization Limited Arbitrary File Read in Jira Server - CVE-2020-29453 - Create and track feature requests for Atlassian products.","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-29453","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-29453","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"29453","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"data_center","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"29453","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"data_center","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"29453","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"29453","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"29453","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira_data_center","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"29453","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira_server","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2020-29453","qid":"730028","title":"Atlassian Jira Server And Data Center Multiple Vulnerabilities(JRASERVER-72014,JRASERVER-72015,JRASERVER-72064)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@atlassian.com","DATE_PUBLIC":"2021-01-21T00:00:00","ID":"CVE-2020-29453","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Atlassian","product":{"product_data":[{"product_name":"Jira Server","version":{"version_data":[{"version_value":"8.5.11","version_affected":"<"},{"version_value":"8.6.0","version_affected":">="},{"version_value":"8.13.3","version_affected":"<"},{"version_value":"8.14.0","version_affected":">="},{"version_value":"8.15.0","version_affected":"<"}]}},{"product_name":"Jira Data Center","version":{"version_data":[{"version_value":"8.5.11","version_affected":"<"},{"version_value":"8.6.0","version_affected":">="},{"version_value":"8.13.3","version_affected":"<"},{"version_value":"8.14.0","version_affected":">="},{"version_value":"8.15.0","version_affected":"<"}]}}]}}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Arbitrary File Read"}]}]},"references":{"reference_data":[{"url":"https://jira.atlassian.com/browse/JRASERVER-72014","refsource":"MISC","name":"https://jira.atlassian.com/browse/JRASERVER-72014"}]}},"nvd":{"publishedDate":"2021-02-22 21:15:00","lastModifiedDate":"2022-03-30 13:29:00","problem_types":["CWE-22"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":3.9,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"8.6.0","versionEndExcluding":"8.13.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.10","versionEndExcluding":"8.5.11","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.10","versionEndExcluding":"8.5.11","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*","versionStartIncluding":"8.6.0","versionEndExcluding":"8.13.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*","versionStartIncluding":"8.14.0","versionEndExcluding":"8.15.0","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"8.14.0","versionEndExcluding":"8.15.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"29453","Ordinal":"192519","Title":"CVE-2020-29453","CVE":"CVE-2020-29453","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"29453","Ordinal":"1","NoteData":"The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"29453","Ordinal":"2","NoteData":"2021-02-18","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"29453","Ordinal":"3","NoteData":"2021-02-18","Type":"Other","Title":"Modified"}]}}}