VULNERABILITY INTELLIGENCE

CVE-2020-4027

CVSS score4.7 MEDIUM

EPSS probability1.52%

CISA KEVNot currently listed

Published2020-07-01

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Description

Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros. The affected versions are before version 7.4.5, and from version 7.5.0 before 7.5.1.

Weakness classification

nvd@nist.gov: CWE-74

Primary references

security@atlassian.com — Issue Tracking, Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Release Notes, Vendor Advisory