CVE-2020-4027

Опубликовано: 01 июл. 2020

Источник: nvd

CVSS3: 4.7

CVSS2: 6.5

EPSS Низкий

Описание

Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros. The affected versions are before version 7.4.5, and from version 7.5.0 before 7.5.1.

Ссылки

https://jira.atlassian.com/browse/CONFSERVER-59898
Issue Tracking
Patch
Release Notes
Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-59898
Issue Tracking
Patch
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*

Версия до 7.4.5 (исключая)

cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*

Версия от 7.5.0 (включая) до 7.5.1 (исключая)

EPSS

Процентиль: 45%

0.00224

Низкий

4.7 Medium

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-74

Связанные уязвимости

GHSA-jp4c-chxh-7gcg

github

около 3 лет назад

Atlassian Confluence Server and Data Center before version 7.5.1 allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros.