CVE-2020-4027

Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros. The affected versions are before version 7.4.5, and from version 7.5.0 before 7.5.1.
References
Link Resource
https://jira.atlassian.com/browse/CONFSERVER-59898 Issue Tracking Patch Release Notes Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*

History

13 Dec 2021, 16:05

Type Values Removed Values Added
CPE cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*

16 Mar 2021, 15:28

Type Values Removed Values Added
References (MISC) https://jira.atlassian.com/browse/CONFSERVER-59898 - Vendor Advisory (MISC) https://jira.atlassian.com/browse/CONFSERVER-59898 - Issue Tracking, Patch, Release Notes, Vendor Advisory

04 Feb 2021, 06:15

Type Values Removed Values Added
Summary Atlassian Confluence Server and Data Center before version 7.5.1 allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros. Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros. The affected versions are before version 7.4.5, and from version 7.5.0 before 7.5.1.

Information

Published : 2020-07-01 02:15

Updated : 2023-12-10 13:27


NVD link : CVE-2020-4027

Mitre link : CVE-2020-4027

CVE.ORG link : CVE-2020-4027


JSON object : View

Products Affected

atlassian

  • confluence
  • confluence_server
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')