CVE-2017-14589
CriticalSummary
There is a possibility of double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags. An attacker with restricted administrative rights to Bamboo can exploit this vulnerability to execute arbitrary Java code on systems running a vulnerable version of Bamboo.
Risk Assessment
The organization is at risk of unauthorized code execution, which could lead to serious security breaches and data loss.
Recommendation
It is recommended to update Bamboo to version 6.1.6 or 6.2.5 to mitigate this vulnerability.
Original NVD description (English source)
It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted administration rights to Bamboo or who hosts a website that a Bamboo administrator visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Bamboo. All versions of Bamboo before 6.1.6 (the fixed version for 6.1.x) and from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) are affected by this vulnerability.