PT-2020-17834 · Atlassian · Companion App+1

Johannes Hatting · Published 2020-06-01 · Updated 2020-06-02 · CVE-2020-4020

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atlassian Companion App versions prior to 1.0.0

Description The issue concerns the file downloading functionality in the Atlassian Companion App, which allows remote attackers who control a connected Confluence Server instance to execute arbitrary .exe files. This is due to a Protection Mechanism Failure.

Recommendations For versions prior to 1.0.0, update to version 1.0.0 or later to resolve the issue.

Fix

Related Identifiers

CVE-2020-4020

Affected Products

Companion App

Confluence

References · 3

• https://jira.atlassian.com/browse/CONFSERVER-59733 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4020 · Security Note
• https://osv.dev/vulnerability/CVE-2020-4020 · Vendor Advisory