CVE-2017-14589
Critical
Description
It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted administration rights to Bamboo or who hosts a website that a Bamboo administrator visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Bamboo. All versions of Bamboo before 6.1.6 (the fixed version for 6.1.x) and from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) are affected by this vulnerability.
SeverityCritical
CVSS9.6
Exploit probability—
Product
Atlassian Bamboo
PublishedDec 13, 2017
First seenDec 13, 2017
How to fix
Update
- atlassian bamboo6.1.6, 6.2.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian bamboo | v < 6.1.6, 6.2.0 ≤ v < 6.2.5 | 6.1.6, 6.2.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.