Uploaded image for project: 'Confluence Server'
  1. Confluence Server
  2. CONFSERVER-52222

Unauthenticated users can view the content of Confluence blogs and pages (CVE-2017-7415)

    XMLWordPrintable

    Details

      Description

      The Confluence drafts diff rest resource made the current content of all blogs and pages in Confluence available without authentication by providing a page id or draft id. Attackers who can access the Confluence web interface of a vulnerable version can use this vulnerability to obtain the content of all blogs and pages inside Confluence provided that they first enumerate page or draft ids.

      Affected versions:

      • All versions of Confluence starting with 6.0.0 before version 6.0.7 are affected by this vulnerability.

      Fix:

       

      Risk Mitigation:

      If you are unable to upgrade right now, this issue can be mitigated in vulnerable versions of Confluence by disabling Collaborative editing as per the following instructions.

      1. Go to   > General Configuration > Collaborative editing.
      2. Change the collaborative editing mode to Off. Be aware that shared drafts will be lost when you switch to this mode, so make sure your users have published any work they want to keep before you make the change.
      3. Refresh the page and check that the Collaborative editing mode has changed to "OFF".

       
      Acknowledgements
      We would like to credit Yuvanesh for reporting this issue to us.

       

      For additional details see the full advisory.

        Attachments

          Issue Links

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                9 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Last commented:
                  2 years, 17 weeks, 3 days ago