Uploaded image for project: 'Bamboo Data Center'
  1. Bamboo Data Center
  2. BAM-21216

Code Injection and Directory Traversal in plexus-utils

XMLWordPrintable

    • 2
    • Low
    • CVE-2017-10004

      This vulnerability allows unauthenticated remote attackers to inject code and XML as well as perform directory traversal via 

      • CVE-2017-1000487 - command injection
      • sonatype-2016-0398 - directory traversal
      • sonatype-2015-0173 - XML Injection 

      The affected versions are before version 7.2.2, and before 8.0.0.

      It's build time vulnerability for Bamboo plugin and Bamboo Specs code.

       

      Affected versions:

      • version < 7.2.2

      Fixed versions:

      • 7.2.2
      • 8.0.0  

      Workaround

      For Bamboo plugin code

      Use parent pom of version 6.1.2

      <parent>
    <groupId>com.atlassian.pom</groupId>
    <artifactId>base-pom</artifactId>
    <version>6.1.2</version>
</parent>

      For Bamboo Specs Java project

      Add these lines to pom.xml

      <build>
  <extensions>
    <extension>
      <groupId>org.apache.maven.wagon</groupId>
      <artifactId>wagon-ssh-external</artifactId>
      <version>3.4.2</version>
    </extension>
  </extensions>
</build>

       

          Form Name

            [BAM-21216] Code Injection and Directory Traversal in plexus-utils

            AB added a comment -

            I have lowered the issue severity as it appears the vulnerable methods were not being used.

            AB added a comment - I have lowered the issue severity as it appears the vulnerable methods were not being used.

            Kaif Ahsan added a comment - - edited

            This is an independent assessment and you should evaluate its applicability to your own IT environment. 

            https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

            CVSS v3 score: 9.8 => Critical severity

            Exploitability Metrics

            Attack Vector Network
            Attack Complexity Low
            Privileges Required None
            User Interaction None

            Scope Metric

            Scope Unchanged

            Impact Metrics

            Confidentiality High
            Integrity High
            Availability High

            See http://go.atlassian.com/cvss for more details.

            https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

            Kaif Ahsan added a comment - - edited This is an independent assessment and you should evaluate its applicability to your own IT environment.  https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v3 score: 9.8 => Critical severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required None User Interaction None Scope Metric Scope Unchanged Impact Metrics Confidentiality High Integrity High Availability High See http://go.atlassian.com/cvss for more details. https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

              c45ee8b91a70 Kaif Ahsan
              security-metrics-bot Security Metrics Bot
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: