Description
The Confluence drafts diff rest resource makes the current content of all blogs and pages in Confluence available without authentication by providing a page id or draft id. Attackers who can access the Confluence web interface of a vulnerable version can use this vulnerability to obtain the content of all blogs and pages inside Confluence provided that they first enumerate page or draft ids. All versions of Confluence starting with 6.0.0 before version 6.0.7 are affected by this vulnerability.
Remediation
Upgrade Confluence to version 6.1.0 or above (recommended)