Skip to main content

Confluence CVE-2015-8399

MEDIUM
Information Exposure (CWE-200)
2016-04-11 cve@mitre.org
Atlassian Information Disclosure Confluence
4.3
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Apr 11, 2016 - 21:59 cve.org
MEDIUM 4.3

DescriptionCVE.org

Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.

AnalysisAI

Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action. Affected products include: Atlassian Confluence. Version information: before 5.8.17.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.

More in Confluence

View all
CVE-2012-2926 CRITICAL POC
9.1 May 22

Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible bef
CVE-2016-6283 MEDIUM POC
6.1 Jan 18

Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.10.6 allows remote attackers to inject arbitra
CVE-2015-8398 MEDIUM POC
6.1 Apr 11

Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitra
CVE-2019-3395 CRITICAL
9.8 Mar 25

The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), f
CVE-2019-3394 HIGH
8.8 Aug 29

There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. Rate
CVE-2017-9505 MEDIUM POC
4.3 Jun 15

Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creatin
CVE-2026-21569 HIGH
7.9 Jan 28

XXE injection in Atlassian Crowd Data Center and Server 7.1.0+ enables authenticated attackers to read local and remote

CVE-2025-13523 HIGH
7.7 Feb 06

Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rend
CVE-2019-15006 MEDIUM
6.5 Dec 19

There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Co
CVE-2017-16856 MEDIUM
6.1 Dec 05

The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or Java
CVE-2016-4317 MEDIUM
5.4 Apr 10

Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page. Rated medium severity (CVSS 5.4), th
CVE-2020-4027 MEDIUM
4.7 Jul 01

Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration per

Same weakness CWE-200 – Information Exposure

View all
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2016-2388 MEDIUM POC
5.3
CVE-2016-1561 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2015-8399 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy