PT-2016-3902 · Atlassian · Confluence

Sebastian Perez · Published 2016-04-11 · Updated 2018-10-09 · CVE-2015-8399

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Atlassian Confluence versions prior to 5.8.17

Description The issue allows remote authenticated users to read configuration files. This can be achieved by manipulating the decoratorName parameter in specific API endpoints, such as "/spaces/viewdefaultdecorator.action" or "/admin/viewdefaultdecorator.action".

Recommendations For versions prior to 5.8.17, update to version 5.8.17 or later to resolve the issue. As a temporary workaround, consider restricting access to the decoratorName parameter in the affected API endpoints until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-8399

Affected Products

Confluence

References · 5

• 🔥 https://exploit-db.com/exploits/39170 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8399 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-8399 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8399 · Note
• http://securityfocus.com/archive/1/537232/100/0/threaded · Note