PT-2018-16815 · Mozilla+2 · Mercurial+2

Zhang Tianqi · Published 2018-03-29 · Updated 2018-04-24 · CVE-2018-5224

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bamboo versions 2.7.0 through 6.3.2 Bamboo versions 6.4.0

Description The issue arises from Bamboo's failure to properly check if a configured Mercurial repository URI contains values that the Windows operating system may consider argument parameters. This allows an attacker with specific permissions to execute code of their choice on systems running a vulnerable version of Bamboo on the Windows operating system.

Recommendations For Bamboo versions 2.7.0 through 6.3.2, update to version 6.3.3 or later. For Bamboo version 6.4.0, update to version 6.4.1 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-5224

Affected Products

Bamboo

Mercurial

Windows

References · 5

• https://confluence.atlassian.com/x/PS9sO · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-5224 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5224 · Security Note
• https://jira.atlassian.com/browse/BAM-19743 · Vendor Advisory
• http://securityfocus.com/bid/103653 · Note