Uploaded image for project: 'Bamboo Data Center'
  1. Bamboo Data Center
  2. BAM-13387

Webwork 2 code injection vulnerability

XMLWordPrintable

      We have discovered a vulnerability in WebWork 2, which is a part of the Struts web framework.

      In specific circumstances, attackers can use this vulnerability to execute Java code of their choice on systems that use these frameworks.

      In case of Bamboo, the attacker needs to be able to access Bamboo Web interface. A valid user account is not required to exploit this vulnerability.

      Customers should be advised that this effects all previously released versions of Bamboo, except Bamboo OnDemand, Bamboo 4.4.8 (or newer) and Bamboo 4.3.5 (or newer). Bamboo 5.0 is not affected.

      For more information on this issue, please see the security advisory here

            Unassigned Unassigned
            jdumay James Dumay
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: