CVE-2017-8907
Description
Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian bamboo | 5.0, 5.0.1, 5.1, 5.1.1, 5.2, 5.2.1, 5.2.2, 5.3, 5.4, 5.4.1, 5.4.2, 5.5, 5.6, 5.6.1, 5.6.2, 5.7, 5.7.1, 5.7.2, 5.8, 5.8.1, 5.8.2, 5.8.5, 5.9, 5.9.1, 5.9.2, 5.9.3, 5.9.4, 5.9.7, 5.11.3, 5.12.0, 5.12.1, 5.12.2, 5.12.4, 5.12.5, 5.13.0, 5.13.1, 5.13.2, 5.14.0, 5.14.1, 5.14.2, 5.14.3, 5.14.4.1, 5.14.5, 5.15.0, 5.15.2, 5.15.3, 5.15.4, 5.15.5, 6.0.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.