CVE-2015-8361: Critical severity bamboo vulnerability

Published Feb 8, 2016

Updated

Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote attackers to obtain sensitive information, modify settings, or manage build agents via unknown vectors involving the JMS port.

Affected Software

90 affected components

Atlassian Bamboo=2.4

Atlassian Bamboo=2.4.1

Atlassian Bamboo=2.4.2

Atlassian Bamboo=2.4.3

Atlassian Bamboo=2.5

Atlassian Bamboo=2.5.1

Atlassian Bamboo=2.5.2

Atlassian Bamboo=2.5.3

Atlassian Bamboo=2.5.5

Atlassian Bamboo=2.6

Atlassian Bamboo=2.6.1

Atlassian Bamboo=2.6.2

Atlassian Bamboo=2.6.3

Atlassian Bamboo=2.7

Atlassian Bamboo=2.7.1

Atlassian Bamboo=2.7.2

Atlassian Bamboo=2.7.3

Atlassian Bamboo=2.7.4

Atlassian Bamboo=3.0

Atlassian Bamboo=3.0.1

Atlassian Bamboo=3.0.2

Atlassian Bamboo=3.0.3

Atlassian Bamboo=3.1

Atlassian Bamboo=3.1.1

Atlassian Bamboo=3.1.3

Atlassian Bamboo=3.1.4

Atlassian Bamboo=3.2

Atlassian Bamboo=3.2.2

Atlassian Bamboo=3.3

Atlassian Bamboo=3.3.1

Atlassian Bamboo=3.3.2

Atlassian Bamboo=3.3.3

Atlassian Bamboo=3.3.4

Atlassian Bamboo=3.4

Atlassian Bamboo=3.4.1

Atlassian Bamboo=3.4.2

Atlassian Bamboo=3.4.3

Atlassian Bamboo=3.4.4

Atlassian Bamboo=3.4.5

Atlassian Bamboo=4.0

Atlassian Bamboo=4.0.1

Atlassian Bamboo=4.1

Atlassian Bamboo=4.1.1

Atlassian Bamboo=4.1.2

Atlassian Bamboo=4.2

Atlassian Bamboo=4.2.1

Atlassian Bamboo=4.3

Atlassian Bamboo=4.3.1

Atlassian Bamboo=4.3.2

Atlassian Bamboo=4.3.3

Atlassian Bamboo=4.3.4

Atlassian Bamboo=4.4

Atlassian Bamboo=4.4.1

Atlassian Bamboo=4.4.2

Atlassian Bamboo=4.4.3

Atlassian Bamboo=4.4.4

Atlassian Bamboo=4.4.5

Atlassian Bamboo=4.4.8

Atlassian Bamboo=5.0

Atlassian Bamboo=5.0-beta1

Atlassian Bamboo=5.0-beta2

Atlassian Bamboo=5.0-beta3

Atlassian Bamboo=5.0-rc1

Atlassian Bamboo=5.0.1

Atlassian Bamboo=5.1

Atlassian Bamboo=5.1.1

Atlassian Bamboo=5.2

Atlassian Bamboo=5.2.1

Atlassian Bamboo=5.2.2

Atlassian Bamboo=5.3

Atlassian Bamboo=5.4

Atlassian Bamboo=5.4.1

Atlassian Bamboo=5.4.2

Atlassian Bamboo=5.5

Atlassian Bamboo=5.6

Atlassian Bamboo=5.6.1

Atlassian Bamboo=5.6.2

Atlassian Bamboo=5.7

Atlassian Bamboo=5.7.1

Atlassian Bamboo=5.7.2

Atlassian Bamboo=5.8

Atlassian Bamboo=5.8.1

Atlassian Bamboo=5.8.2

Atlassian Bamboo=5.8.5

Atlassian Bamboo=5.9

Atlassian Bamboo=5.9.1

Atlassian Bamboo=5.9.2

Atlassian Bamboo=5.9.3

Atlassian Bamboo=5.9.4

Atlassian Bamboo=5.9.7

Remediation

Patch Available

https://jira.atlassian.com/browse/BAM-17102

Event History

Feb 8, 2016

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-8361?

CVE-2015-8361 has been rated as critical due to its potential to allow unauthorized access to sensitive information and configuration settings.

How do I fix CVE-2015-8361?

To fix CVE-2015-8361, upgrade Atlassian Bamboo to version 5.9.9 or later for the 5.9.x release, or version 5.10.0 or later for the 5.10.x series.

What types of systems are affected by CVE-2015-8361?

CVE-2015-8361 affects multiple versions of Atlassian Bamboo prior to 5.9.9 and 5.10.x prior to 5.10.0.

Can CVE-2015-8361 lead to data leakage?

Yes, CVE-2015-8361 can result in unauthorized data leakage and manipulation due to the lack of authentication controls.

What action should I take if I am not able to upgrade to fix CVE-2015-8361?

If an upgrade is not feasible, consider implementing additional network security measures, such as blocking access to the JMS port to mitigate risks associated with CVE-2015-8361.