CVE-2017-8907
HighSummary
Atlassian Bamboo versions 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission. An attacker who can log in as a user without these permissions can create a deployment project and execute arbitrary code on an available Bamboo Agent.
Risk Assessment
The organization is at risk of arbitrary code execution on the system hosting Bamboo, which could lead to serious security breaches.
Recommendation
It is recommended to update Atlassian Bamboo to the latest version to ensure proper permission checks and minimize the risk of unauthorized access.
Other vulnerabilities in Atlassian Bamboo
See all- CVE-2016-5229Critical
Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, allowing remote attackers to execute arbitrary code via vectors related to XStream Serialization.
- CVE-2015-8361Critical
Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, allowing remote attackers to obtain sensitive information, modify settings, or manage build agents.
- CVE-2015-8360Critical
An unspecified vulnerability in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.
Original NVD description (English source)
Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.