CVE-2012-2926

CRITICAL

Atlassian Bamboo < 3.3.4 - XML External Entity Injection

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2012-2926. PoCs published by anonymous, Will Caput, Trevor Hartman, Thaddeus Bogner, juan vazquez, including Metasploit module auxiliary/scanner/http/atlassian_crowd_fileaccess.

AI-analyzed exploit summary This exploit leverages an XML Entity Expansion (XEE) vulnerability in JIRA and its plugins (Gliffy and Tempo) to cause a denial-of-service (DoS) by sending a crafted SOAP request with exponentially expanding XML entities.

Description

Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.

Exploits (2)

exploitdb WORKING POC VERIFIED

by anonymous · textdosjsp

https://www.exploit-db.com/exploits/37218

View Code ZIP pw:eip

This exploit leverages an XML Entity Expansion (XEE) vulnerability in JIRA and its plugins (Gliffy and Tempo) to cause a denial-of-service (DoS) by sending a crafted SOAP request with exponentially expanding XML entities.

Classification

Working Poc 90%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: JIRA (prior to 5.0.1), Gliffy (prior to 3.7.1), Tempo (prior to 6.4.3.1, 6.5.1, 7.0.3)

No auth needed

Prerequisites: Network access to the target JIRA instance

MITRE ATT&CK

T1505 - Server Software Component T1499.004 - Application or System Exploitation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC

by Will Caput, Trevor Hartman, Thaddeus Bogner, juan vazquez · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/atlassian_crowd_fileaccess.rb

View Code ZIP pw:eip

This Metasploit module exploits an XML External Entity (XXE) vulnerability in Atlassian Crowd to read arbitrary files from the server. It crafts a malicious SOAP request with an external entity reference to leak file contents via error messages.

Classification

Working Poc 95%

Attack Type

Info Leak

Complexity

Moderate

Reliability

Reliable

Target: Atlassian Crowd (versions affected by CVE-2012-2926)

No auth needed

Prerequisites: Network access to Atlassian Crowd SOAP interface (default port 8095) · Knowledge of target file path

MITRE ATT&CK