-
Bug
-
Resolution: Fixed
-
High
-
6.0.1, 5.15.7, 6.0.3
-
Severity 3 - Minor
-
Summary
User without global admin or restricted admin permission is not able to clone a deployment environment
Steps to Reproduce
- Create a user and add to it all permissions in global permissions except the Admin
- Login with this user create a deployment project and an environment
- Try to clone the environment by going to Deployment config >> (your_env) >> Actions >> Clone
Expected Results
Bamboo will show the next screen to set the name of the cloned environment and later will succeed the cloning
Actual Results
An access denied page is shown
Workaround
- download atlassian-bamboo-deployments-5.15.7-BAM-18492.jar for v5.15.7 or atlassian-bamboo-deployments-6.0.3-BAM-18492.jar for v6.0.x
- stop Bamboo
- move (do not delete) <bamboo-install>/atlassian-bamboo/WEB-INF/lib/atlassian-bamboo-deployments-5.15.7.jar to a directory outside <bamboo-install>
- place atlassian-bamboo-deployments-5.15.7-BAM-18492.jar into <bamboo-install>/atlassian-bamboo/WEB-INF/lib/ directory
- start Bamboo
Users/groups with edit permission on Deployment project will be able to clone an environment.
- is caused by
-
BAM-18405 Incorrect permission check for deployment projects (CVE-2017-8907)
- Closed