Vulnerability · Published Jun 1, 2020 · Assigned by atlassian
CVE-2020-4020
High 7.2
In plain English
A high-severity security flaw in Companion App from Atlassian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS NVD)7.2High
Exploit odds (30 days)1.7%top 23.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The file downloading functionality in the Atlassian Companion App before version 1.0.0 allows remote attackers, who control a Confluence Server instance that the Companion App is connected to, execute arbitrary .exe files via a Protection Mechanism Failure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Companion App | unspecified – before 1.0.0 |
References
- https://jira.atlassian.com/browse/CONFSERVER-59733 x_refsource_MISC