Details
-
Type:
Bug
-
Status: Closed (View Workflow)
-
Priority:
High
-
Resolution: Fixed
-
Affects Version/s: 2.3.1, 5.9.7
-
Component/s: None
-
Bug Fix Policy:
Description
Bamboo had a resource that deserialised arbitrary user input without restriction. Attackers can use this vulnerability to execute Java code of their choice on systems that have a vulnerable version of Bamboo. To exploit this issue, attackers need to be able to access the Bamboo JMS port (port 54663 by default).
Affected versions:
- All versions of Bamboo from 2.3.1 before 5.9.9 (the fixed version for 5.9.x) are affected by this vulnerability.
Fix:
- Bamboo 5.10.0 is available for download from https://www.atlassian.com/software/bamboo/download.
- Bamboo 5.9.9 is available for download from https://www.atlassian.com/software/bamboo/download-archives.
For additional details see the full advisory.