QwikSec

Security Database

CVE

CWE

Training

CVE-2017-9514

Published: Oct 12, 2017

Modified: Aug 5, 2024

PUBLISHED

Description

Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. An attacker who can log in to Bamboo as a user is able to exploit this vulnerability to execute Java code of their choice on systems that have vulnerable versions of Bamboo.

Vendor	Product	Versions
Atlassian	Bamboo	affected `from 6.0.0 before 6.0.5` affected `from 6.1.0 before 6.1.4` affected `from 6.2.0 before 6.2.1`

References

https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-10-11-938843921.html

x_refsource_CONFIRM

vdb-entry

x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.