PT-2017-13566 · Atlassian · Bamboo

Zhang Tianqi · Publicado 2017-12-13 · Atualizado 2019-10-03 · CVE-2017-14590

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bamboo versions 2.7.0 through 6.1.5 Bamboo versions 6.2.0 through 6.2.4

Description The issue allows an attacker with specific permissions to execute code of their choice on systems running a vulnerable version of Bamboo Server. This can be achieved by creating a repository, editing a plan, or committing to a Mercurial repository used by a Bamboo plan with branch detection enabled, if the attacker has permission to use the repository.

Recommendations For Bamboo versions 2.7.0 through 6.1.5, update to version 6.1.6 or later. For Bamboo versions 6.2.0 through 6.2.4, update to version 6.2.5 or later.

Correção

Identificadores relacionados

CVE-2017-14590

Produtos afetados

Bamboo

Referências · 6

• https://osv.dev/vulnerability/CVE-2017-14590 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14590 · Nota de Segurança
• https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14590 · Nota de Segurança
• https://jira.atlassian.com/browse/BAM-18843 · Aviso do Fabricante
• http://securityfocus.com/bid/102193 · Nota