PT-2017-13566 · Atlassian · Bamboo

Zhang Tianqi · Published 2017-12-13 · Updated 2019-10-03 · CVE-2017-14590

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bamboo versions 2.7.0 through 6.1.5 Bamboo versions 6.2.0 through 6.2.4

Description The issue allows an attacker with specific permissions to execute code of their choice on systems running a vulnerable version of Bamboo Server. This can be achieved by creating a repository, editing a plan, or committing to a Mercurial repository used by a Bamboo plan with branch detection enabled, if the attacker has permission to use the repository.

Recommendations For Bamboo versions 2.7.0 through 6.1.5, update to version 6.1.6 or later. For Bamboo versions 6.2.0 through 6.2.4, update to version 6.2.5 or later.

Fix

Related Identifiers

CVE-2017-14590

Affected Products

Bamboo

References · 6

• https://osv.dev/vulnerability/CVE-2017-14590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14590 · Security Note
• https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14590 · Security Note
• https://jira.atlassian.com/browse/BAM-18843 · Vendor Advisory
• http://securityfocus.com/bid/102193 · Note