-
Type:
Public Security Vulnerability
-
Resolution: Fixed
-
Priority:
High
-
Affects Version/s: 9.6.0, 10.0.0, 9.6.1, 9.6.2, 9.6.3, 9.6.4, 9.6.5, 9.6.6, 10.1.0, 10.0.1, 9.6.7, 10.0.2, 9.6.8, 10.0.3, 10.2.0, 9.6.9, 10.1.1, 9.6.10, 10.2.1, 10.2.2, 10.2.3, 9.6.11, 9.6.12, 10.2.4, 9.6.13, 9.6.14, 10.2.5, 10.2.6, 9.6.15, 10.2.7, 9.6.16, 10.2.8, 9.6.17, 9.6.18, 10.2.9, 10.2.10, 9.6.19, 10.2.11, 9.6.20, 9.6.21, 10.2.12, 10.2.13, 9.6.22, 10.2.14, 10.2.15, 9.6.23
-
Component/s: None
-
8.1
-
High
-
CVE-2025-68493
-
Atlassian (Internal)
-
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
-
DOM-based XSS
-
Bamboo Data Center
This High severity Missing XML Validation vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0 and 10.2.0 of Bamboo Data Center.
This Missing XML Validation vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N allows an plugin vendor to introduce incorrect configuration to XWork module and make it vulnerable to XML external entity (XXE) injection.
Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
- Bamboo Data Center 9.6: Upgrade to a release greater than or equal to 9.6.24
- Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.16
See the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives).