Uploaded image for project: 'Bamboo Data Center'
  1. Bamboo Data Center
  2. BAM-10627

Code injection vulnerability

XMLWordPrintable

      We have identified and fixed a code injection vulnerability in Bamboo caused by an underlying vulnerability in the third-party Webwork 2 framework.

      All versions of Bamboo from 3.0 up are affected.

      This issue is reported in our security advisory on this page:
      http://confluence.atlassian.com/x/MgFTE

      This vulnerability is a variant of a recently disclosed Struts2 vulnerability.

        1. SimpleConversionErrorInterceptor.zip
          3 kB

            [BAM-10627] Code injection vulnerability

            Monique Khairuliana (Inactive) made changes -
            Workflow Original: Bamboo Workflow 2016 v1 - Restricted [ 1435408 ] New: JAC Bug Workflow v3 [ 3379492 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            David Black made changes -
            Labels Original: advisory cvss-critical security New: advisory advisory-released cvss-critical security
            Owen made changes -
            Workflow Original: Bamboo Workflow 2016 v1 [ 1410107 ] New: Bamboo Workflow 2016 v1 - Restricted [ 1435408 ]
            Marek Went (Inactive) made changes -
            Workflow Original: Bamboo Workflow 2014 v2 [ 610385 ] New: Bamboo Workflow 2016 v1 [ 1410107 ]
            Security Metrics Bot made changes -
            Labels Original: advisory security New: advisory cvss-critical security
            James Dumay made changes -
            Workflow Original: Bamboo Workflow 2014 [ 593054 ] New: Bamboo Workflow 2014 v2 [ 610385 ]
            James Dumay made changes -
            Workflow Original: Bamboo Workflow 2010 [ 360955 ] New: Bamboo Workflow 2014 [ 593054 ]
            VitalyA made changes -
            Fix Version/s Original: 4.0 M1 [ 22493 ]
            Resolution New: Fixed [ 1 ]
            Status Original: Open [ 1 ] New: Resolved [ 5 ]
            VitalyA made changes -
            Fix Version/s New: 4.0 M1 [ 22493 ]
            VitalyA made changes -
            Fix Version/s Original: 4.0 M1 [ 22493 ]

              vosipov VitalyA
              pwatson paulwatson (Inactive)
              Affected customers:
              0 This affects my team
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: