PT-2017-13565 · Apache+1 · Freemarker+2

Sebastian Perez · Publicado 2017-12-13 · Atualizado 2018-01-10 · CVE-2017-14589

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bamboo versions prior to 6.1.6 Bamboo versions 6.2.0 through 6.2.4

Description The issue allows for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags. An attacker with restricted administration rights to Bamboo, or who hosts a website visited by a Bamboo administrator, can exploit this to execute Java code of their choice on systems running a vulnerable version of Bamboo.

Recommendations For Bamboo versions prior to 6.1.6, update to version 6.1.6 or later. For Bamboo versions 6.2.0 through 6.2.4, update to version 6.2.5 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-14589

Produtos afetados

Bamboo

Freemarker

Struts

Referências · 6

• https://jira.atlassian.com/browse/BAM-18842 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-14589 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14589 · Nota de Segurança
• https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14589 · Nota de Segurança
• http://securityfocus.com/bid/102188 · Nota