PT-2017-13565 · Apache+1 · Freemarker+2

Sebastian Perez · Published 2017-12-13 · Updated 2018-01-10 · CVE-2017-14589

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bamboo versions prior to 6.1.6 Bamboo versions 6.2.0 through 6.2.4

Description The issue allows for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags. An attacker with restricted administration rights to Bamboo, or who hosts a website visited by a Bamboo administrator, can exploit this to execute Java code of their choice on systems running a vulnerable version of Bamboo.

Recommendations For Bamboo versions prior to 6.1.6, update to version 6.1.6 or later. For Bamboo versions 6.2.0 through 6.2.4, update to version 6.2.5 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-14589

Affected Products

Bamboo

Freemarker

Struts

References · 6

• https://jira.atlassian.com/browse/BAM-18842 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14589 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14589 · Security Note
• https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14589 · Security Note
• http://securityfocus.com/bid/102188 · Note