High We have identified and fixed a vulnerability in Bamboo that results from the way third-party XML parsers are used in Bamboo.
This vulnerability allows an attacker to:
- Execute denial of service attacks against the Bamboo server, and
- Read all local files readable to the system user under which Bamboo runs.
The attacker needs to have an account with the affected Bamboo server instance and be able to log in in order to execute the attack.
All versions of Bamboo up to and including 3.4.4 are affected.
Full details of the severity, risks and vulnerability can be found in the Bamboo Security Advisory 2012-05-17.
- mentioned in
-
![[Atlassian Documentation] Page](/images/icons/generic_link_16.png "[Atlassian Documentation] Page")
Page
No Confluence page found with the given URL.
-
Page
No Confluence page found with the given URL.
-
Page
No Confluence page found with the given URL.
-
Page
No Confluence page found with the given URL.
-
Page Loading...
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
![[Atlassian Documentation] Page](https://confluence.atlassian.com/images/icons/favicon.png "[Atlassian Documentation] Page"){kind=icon}
Installing the patch: (we recommend upgrading instead of patching)