• Type: Bug
• Resolution: Fixed
• Priority: High
• Fix Version/s: 6.3.1
• Affects Version/s: None
• Component/s: None
• Labels:

  • CVE-2017-18042
  • advisory
  • advisory-released
  • bamboo-bugfix-kanban
  • bugbounty
  • csrf
  • cvss-high
  • security
  • xsrf

[BAM-19663] Cross-site request forgery (CSRF) in the update user administration resource - CVE-2017-18042

Monique Khairuliana (Inactive) made changes - 19/Aug/2019 2:04 AM

Workflow	Original: Bamboo Workflow 2016 v1 - Restricted [ 2594777 ]	New: JAC Bug Workflow v3 [ 3384734 ]
Status	Original: Resolved [ 5 ]	New: Closed [ 6 ]

Owen made changes - 24/Oct/2018 5:05 AM

Symptom Severity

Original: Major [ 14431 ]

New: Severity 2 - Major [ 15831 ]

David Black made changes - 02/Feb/2018 4:05 AM

Labels

Original: CVE-2017-18042 advisory advisory-to-release bamboo-bugfix-kanban bugbounty csrf cvss-high security xsrf

New: CVE-2017-18042 advisory advisory-released bamboo-bugfix-kanban bugbounty csrf cvss-high security xsrf

David Black made changes - 02/Feb/2018 4:05 AM

Priority

Original: Low [ 4 ]

New: High [ 2 ]

David Black made changes - 02/Feb/2018 4:05 AM

Security

Original: Atlassian Staff [ 10750 ]

David Black made changes - 02/Feb/2018 4:03 AM

Labels

Original: advisory advisory-to-release bamboo-bugfix-kanban bugbounty csrf cvss-high security xsrf

New: CVE-2017-18042 advisory advisory-to-release bamboo-bugfix-kanban bugbounty csrf cvss-high security xsrf

David Black made changes - 02/Feb/2018 4:03 AM

Summary

Original: Sanitised security issue 3687190497d78cdcbcff1d1feadbb9eeecbdbbf2accdd992cc83566c8eb184d9

New: Cross-site request forgery (CSRF) in the update user administration resource - CVE-2017-18042

David Black made changes - 02/Feb/2018 4:02 AM

Description

Original: Component in Atlassian Bamboo from version None before version 6.3.1 allows remote attackers to modify <INSERT_HERE> via a Cross-site request forgery (CSRF) vulnerability.

New: The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-site request forgery (CSRF) vulnerability.

David Black made changes - 02/Feb/2018 3:35 AM

Resolution		New: Fixed [ 1 ]
Status	Original: Needs Triage [ 10030 ]	New: Resolved [ 5 ]

David Black made changes - 02/Feb/2018 3:12 AM

Fix Version/s

New: 6.3.1 [ 76995 ]

Load more older events