PT-2024-4767 · Atlassian · Bamboo

Bug Bounty

·

Published

2024-07-16

·

Updated

2024-10-24

·

CVE-2024-21687

CVSS v2.0

8.5

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:N
Name of the Vulnerable Software and Affected Versions: Atlassian Bamboo Data Center and Server versions 9.0.0 through 9.6.0
Description: The issue is related to a File Inclusion vulnerability that allows an authenticated attacker to display the contents of a local file or execute different files already stored locally on the server. This has a high impact on confidentiality and integrity but no impact on availability, and it requires no user interaction.
Recommendations: For versions 9.6.0 to 9.6.3 LTS, upgrade to 9.6.4 LTS. For versions from 9.5.0 to 9.5.4, upgrade to 9.6.4 LTS. For versions from 9.4.0 to 9.4.3, upgrade to 9.6.4 LTS. For versions from 9.3.0 to 9.3.6, upgrade to 9.6.4 LTS. For versions from 9.2.0 to 9.2.15 LTS, upgrade to 9.6.4 LTS or 9.2.16 LTS. For versions from 9.1.0 to 9.1.3, upgrade to 9.6.4 LTS or 9.2.16 LTS. For versions from 9.0.0 to 9.0.4, upgrade to 9.6.4 LTS or 9.2.16 LTS. For any earlier versions, upgrade to 9.6.4 LTS or 9.2.16 LTS.

Fix

File Inclusion

Special Elements Injection

Weakness Enumeration

CWE-98CWE-74

Related Identifiers

BDU:2024-05290
CVE-2024-21687

Affected Products

Bamboo