Uploaded image for project: 'Bamboo Data Center'
  1. Bamboo Data Center
  2. BAM-12066

OGNL injection vulnerability

XMLWordPrintable

      We have identified and fixed a vulnerability caused by the way WebWorks/Struts and Freemarker templates are used in Bamboo.

      The vulnerability allows a non-authenticated user to execute arbitrary Java methods in the JVM hosting the Bamboo application. This can be used to execute OS commands as the JVM user.

      All versions of Bamboo up to and including 4.0.1 are affected.

      Full details are available in the advisory at https://confluence.atlassian.com/display/BAMBOO/Bamboo+Security+Advisory+2012-08-28

        1. BAM-12066.zip
          3.87 MB

          Form Name

            [BAM-12066] OGNL injection vulnerability

            Jacek Krawczyk (Inactive) made changes -
            Remote Link Original: This issue links to "Page (Atlassian Documentation)" [ 716861 ]
            Jacek Krawczyk (Inactive) made changes -
            Remote Link New: This issue links to "Page (Atlassian Documentation)" [ 716861 ]
            Jacek Krawczyk (Inactive) made changes -
            Remote Link Original: This issue links to "Page (Atlassian Documentation)" [ 715488 ]
            Jacek Krawczyk (Inactive) made changes -
            Remote Link New: This issue links to "Page (Atlassian Documentation)" [ 715488 ]
            Monique Khairuliana (Inactive) made changes -
            Workflow Original: Bamboo Workflow 2016 v1 - Restricted [ 1442479 ] New: JAC Bug Workflow v3 [ 3383387 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Rachel Robins made changes -
            Remote Link Original: This issue links to "Page (Atlassian Documentation)" [ 235433 ] New: This issue links to "Page (Atlassian Documentation)" [ 235433 ]
            Rachel Robins made changes -
            Remote Link New: This issue links to "Page (Atlassian Documentation)" [ 235433 ]
            Rachel Robins made changes -
            Remote Link Original: This issue links to "Page (Atlassian Documentation)" [ 235208 ] New: This issue links to "Page (Atlassian Documentation)" [ 235208 ]
            Rachel Robins made changes -
            Remote Link New: This issue links to "Page (Atlassian Documentation)" [ 235208 ]
            Michalina made changes -
            Remote Link Original: This issue links to "Page (Atlassian Documentation)" [ 216778 ] New: This issue links to "Page (Atlassian Documentation)" [ 216778 ]

              vosipov VitalyA
              pbruski Przemek Bruski
              Affected customers:
              0 This affects my team
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: