CVE-2017-9514

HIGH

Bamboo <6.0.5, <6.1.x-6.1.4, <6.2.x-6.2.1 - Code Injection

Title source: llm
STIX 2.1

Description

Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. An attacker who can log in to Bamboo as a user is able to exploit this vulnerability to execute Java code of their choice on systems that have vulnerable versions of Bamboo.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/101269

Scores

CVSS v3 8.8
EPSS 0.0031
EPSS Percentile 54.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-732
Status published
Products (11)
atlassian/bamboo 6.0.0
atlassian/bamboo 6.0.1
atlassian/bamboo 6.0.2
atlassian/bamboo 6.0.3
atlassian/bamboo 6.0.4
atlassian/bamboo 6.1.0
atlassian/bamboo 6.1.1
atlassian/bamboo 6.2.0
Atlassian/Bamboo from 6.0.0 before 6.0.5
Atlassian/Bamboo from 6.1.0 before 6.1.4
... and 1 more
Published Oct 12, 2017
Tracked Since Feb 18, 2026