Uploaded image for project: 'Bamboo'
  1. Bamboo
  2. BAM-14038

Privilege escalation

    XMLWordPrintable

Details

    Description

      We have identified and fixed a vulnerability in Bamboo which allowed unauthenticated users to commit actions on behalf of any other authorised user. In order to exploit this vulnerability, an attacker requires access to your Bamboo web interface.

      A Bamboo server is only vulnerable if it has been configured to be a part of an Application link with Trusted Applications authentication. This is not the default configuration.

      The vulnerability affects all supported versions of Bamboo up to and including 5.2.1. It has been fixed in 5.2.2.

      For more information, see our security advisory.

      Attachments

        1. patch_bamboo_5_0_1.tar.gz
          178 kB
        2. patch_bamboo_5_1_1.tar.gz
          178 kB
        3. patch_bamboo_5_2_1.tar.gz
          178 kB

        Issue Links

          Activity

            People

              Unassigned Unassigned
              rbattaglin Renan Battaglin
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: