Description

Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros. The affected versions are before version 7.4.5, and from version 7.5.0 before 7.5.1.

Remediation

References

CVE-2020-4027

Related Vulnerabilities

WordPress Plugin Invit0r 'ofc_upload_image.php' Arbitrary File Upload (0.22)

osCommerce Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-43728)

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-1003050)

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-3065)

WordPress Plugin Booking Calendar Contact Form Multiple Vulnerabilities (1.0.2)

Severity

Medium

Classification

CVE-2020-4027 CWE-138 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities