CVE-2015-8399 PoC — Atlassian Confluence 信息泄露漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-8399.yaml

Associated Vulnerability

Title:Atlassian Confluence 信息泄露漏洞 (CVE-2015-8399)
Description:Atlassian Confluence是澳大利亚Atlassian公司的一套专业的企业知识管理与协同软件，也可以用于构建企业WiKi。该软件可实现团队成员之间的协作和知识共享。 Atlassian Confluence 5.8.17之前版本中存在安全，该漏洞源于spaces/viewdefaultdecorator.action和admin/viewdefaultdecorator.action文件没有充分过滤‘decoratorName’参数。远程攻击者可利用该漏洞读取配置文件。

Description

Atlassian Confluence before 5.8.17 contains an information disclsoure vulnerability. A remote authenticated user can read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.

File Snapshot


 id: CVE-2015-8399

info:
  name: Atlassian Confluence <5.8.17 - Information Disclosure
  author: pri

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!