« Volver al listado

CVE-2018-20237

Estado: ModificadaMedia (6.5)—

Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted page via the word export feature.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Atlassian — Confluence Data CenterAtlassian — Confluence Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-20237",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@atlassian.com",
      "affectedData": [
        {
          "vendor": "Atlassian",
          "product": "Confluence Server",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "6.13.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Atlassian",
          "product": "Confluence Data Center",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "6.13.1",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-02-13T18:29:00.667",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/107041",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://jira.atlassian.com/browse/CONFSERVER-57814",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://www.excellium-services.com/cert-xlm-advisory/cve-2018-20237/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/107041",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jira.atlassian.com/browse/CONFSERVER-57814",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.excellium-services.com/cert-xlm-advisory/cve-2018-20237/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted page via the word export feature."
    },
    {
      "lang": "es",
      "value": "Atlassian Confluence Server and Data Center, en versiones anteriores a la 6.13.1, permite que un usuario autenticado descargue una página eliminada mediante la característica de exportación de palabras."
    }
  ],
  "lastModified": "2026-06-17T01:52:32.483",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF2CCA37-B9C8-46C3-B839-25F287BFE635",
              "versionEndExcluding": "6.13.1"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "281F6F1E-E4D1-436F-928E-535816C24954",
              "versionEndExcluding": "6.14.0",
              "versionStartIncluding": "6.13.2"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5F58782-D4F6-46BC-BFBC-187372FEB8DB",
              "versionEndExcluding": "6.13.1"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81398F6D-D05D-4B06-945C-7B429D11A839",
              "versionEndExcluding": "6.14.0",
              "versionStartIncluding": "6.13.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@atlassian.com"
}