CVE-2017-9514
HIGHBamboo <6.0.5, <6.1.x-6.1.4, <6.2.x-6.2.1 - Code Injection
Title source: llmDescription
Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. An attacker who can log in to Bamboo as a user is able to exploit this vulnerability to execute Java code of their choice on systems that have vulnerable versions of Bamboo.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-10-11-938843921.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/101269
Scores
CVSS v3
8.8
EPSS
0.0031
EPSS Percentile
54.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-732
Status
published
Products (11)
atlassian/bamboo
6.0.0
atlassian/bamboo
6.0.1
atlassian/bamboo
6.0.2
atlassian/bamboo
6.0.3
atlassian/bamboo
6.0.4
atlassian/bamboo
6.1.0
atlassian/bamboo
6.1.1
atlassian/bamboo
6.2.0
Atlassian/Bamboo
from 6.0.0 before 6.0.5
Atlassian/Bamboo
from 6.1.0 before 6.1.4
... and 1 more
Published
Oct 12, 2017
Tracked Since
Feb 18, 2026