.. / CVE-2020-29453

• LFI
• Nuclei
• Web

Exploit for Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF) (CVE-2020-29453)

Description:

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

Nuclei Template

View the template here CVE-2020-29453.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-29453.yaml

References: