2017-06-14 22:29:00 2019-10-03 02:03:26

Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.

Vector

NETWORK

Complexity

LOW

Authentication

SINGLE_INSTANCE

Confidentiality

PARTIAL

Integrity

PARTIAL

Availability

PARTIAL
Atlassian Bamboo 5.15.4 (not an official CPE) Atlassian Bamboo 5.15.3 (not an official CPE) Atlassian Bamboo 5.15.2 (not an official CPE) Atlassian Bamboo 5.15.0 (not an official CPE) Atlassian Bamboo 5.14.5 (not an official CPE) Atlassian Bamboo 5.14.4.1 (not an official CPE) Atlassian Bamboo 5.14.3 (not an official CPE) Atlassian Bamboo 5.14.2 (not an official CPE) Atlassian Bamboo 5.14.1 (not an official CPE) Atlassian Bamboo 5.14.0 (not an official CPE) Atlassian Bamboo 5.13.2 (not an official CPE) Atlassian Bamboo 5.13.1 (not an official CPE) Atlassian Bamboo 5.13.0 (not an official CPE) Atlassian Bamboo 5.12.5 (not an official CPE) Atlassian Bamboo 5.12.4 (not an official CPE) Atlassian Bamboo 5.12.2 (not an official CPE) Atlassian Bamboo 5.12.1 (not an official CPE) Atlassian Bamboo 5.12.0 (not an official CPE) Atlassian Bamboo 5.11.3 (not an official CPE) Atlassian Bamboo 5.9.7 (not an official CPE) Atlassian Bamboo 5.9.4 (not an official CPE) Atlassian Bamboo 5.9.3 (not an official CPE) Atlassian Bamboo 5.9.2 (not an official CPE) Atlassian Bamboo 5.9.1 (not an official CPE) Atlassian Bamboo 5.9 (not an official CPE) Atlassian Bamboo 5.8.5 (not an official CPE) Atlassian Bamboo 5.8.2 (not an official CPE) Atlassian Bamboo 5.8.1 (not an official CPE) Atlassian Bamboo 5.8 (not an official CPE) Atlassian Bamboo 5.7.2 (not an official CPE) Atlassian Bamboo 5.7.1 (not an official CPE) Atlassian Bamboo 5.7 (not an official CPE) Atlassian Bamboo 5.6.2 (not an official CPE) Atlassian Bamboo 5.6.1 (not an official CPE) Atlassian Bamboo 5.6 (not an official CPE) Atlassian Bamboo 5.5 (not an official CPE) Atlassian Bamboo 5.4.2 (not an official CPE) Atlassian Bamboo 5.4.1 (not an official CPE) Atlassian Bamboo 5.4 (not an official CPE) Atlassian Bamboo 5.3 (not an official CPE) Atlassian Bamboo 5.2.2 (not an official CPE) Atlassian Bamboo 5.2.1 (not an official CPE) Atlassian Bamboo 5.2 (not an official CPE) Atlassian Bamboo 5.1.1 (not an official CPE) Atlassian Bamboo 5.1 (not an official CPE) Atlassian Bamboo 5.0.1 (not an official CPE) Atlassian Bamboo 5.0 Rc1 (not an official CPE) Atlassian Bamboo 5.0 Beta3 (not an official CPE) Atlassian Bamboo 5.0 Beta2 (not an official CPE) Atlassian Bamboo 5.0 Beta1 (not an official CPE) Atlassian Bamboo 5.0 (not an official CPE) Atlassian Bamboo 5.15.5 (not an official CPE) Atlassian Bamboo 6.0.0 (not an official CPE)