Lucene search

AtlassianCVE-2020-4027

HistoryJul 01, 2020 - 2:15 a.m.

CVE-2020-4027

2020-07-0102:15:12

CWE-74

atlassian

web.nvd.nist.gov

atlassian

confluence

server

data center

cve-2020-4027

injection vulnerability

security advisory

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

43.2%

JSON

Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros. The affected versions are before version 7.4.5, and from version 7.5.0 before 7.5.1.

Affected configurations

Nvd

Node

atlassianconfluenceRange<7.4.5

atlassianconfluence_serverRange7.5.0–7.5.1

VendorProductVersionCPE
atlassianconfluence*cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*
atlassianconfluence_server*cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
atlassian	confluence	*	cpe:2.3:a:atlassian:confluence::::::::
atlassian	confluence_server	*	cpe:2.3:a:atlassian:confluence_server::::::::

CNA Affected

[
  {
    "product": "Confluence Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "7.4.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.5.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.5.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Confluence Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "7.4.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.5.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.5.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

jira.atlassian.com/browse/CONFSERVER-59898

Social References

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

43.2%

JSON

Related for CVE-2020-4027