PT-2017-18982 · Atlassian · Bamboo

Published 2017-10-12 · Updated 2019-10-03 · CVE-2017-9514

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bamboo versions prior to 6.0.5 Bamboo versions 6.1.x prior to 6.1.4 Bamboo versions 6.2.x prior to 6.2.1

Description The issue concerns a REST endpoint that parses a YAML file but does not sufficiently restrict which classes can be loaded. An attacker with login credentials to Bamboo can exploit this to execute Java code of their choice on systems running vulnerable versions of Bamboo.

Recommendations For versions prior to 6.0.5, update to version 6.0.5 or later. For versions 6.1.x prior to 6.1.4, update to version 6.1.4 or later. For versions 6.2.x prior to 6.2.1, update to version 6.2.1 or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-9514

Affected Products

Bamboo

References · 5

• https://osv.dev/vulnerability/CVE-2017-9514 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9514 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-9514 · Security Note
• https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-10-11-938843921.html · Vendor Advisory
• http://securityfocus.com/bid/101269 · Note