CVE-2012-2926
CRITICALAtlassian Bamboo < 3.3.4 - Denial of Service
Title source: ruleDescription
Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
Exploits (2)
metasploit
WORKING POC
by Will Caput, Trevor Hartman, Thaddeus Bogner, juan vazquez · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/atlassian_crowd_fileaccess.rb
References (10)
Scores
CVSS v3
9.1
EPSS
0.6761
EPSS Percentile
98.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Details
Status
published
Products (7)
atlassian/bamboo
< 3.3.4
atlassian/confluence
< 3.5.16
atlassian/confluence_server
4.0 - 4.0.7
atlassian/crowd
< 2.0.9
atlassian/crucible
< 2.5.8
atlassian/fisheye
< 2.5.8
atlassian/jira
< 5.0.1
Published
May 22, 2012
Tracked Since
Feb 18, 2026