.. / CVE-2015-8399

Exploit for Atlassian Confluence <5.8.17 - Information Disclosure (CVE-2015-8399)

Description:

Atlassian Confluence before 5.8.17 contains an information disclsoure vulnerability. A remote authenticated user can read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.

Nuclei Template

View the template here CVE-2015-8399.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2015/CVE-2015-8399.yaml
Copy

References:

https://nvd.nist.gov/vuln/detail/CVE-2015-8399
https://www.exploit-db.com/exploits/39170/
https://jira.atlassian.com/browse/CONFSERVER-39704?src=confmacro