CVE-2017-14589: Input Validation
First published: Wed Dec 13 2017(Updated: )
It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted administration rights to Bamboo or who hosts a website that a Bamboo administrator visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Bamboo. All versions of Bamboo before 6.1.6 (the fixed version for 6.1.x) and from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) are affected by this vulnerability.
Credit: security@atlassian.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Atlassian Bamboo | <6.1.6 | |
| Atlassian Bamboo | >=6.2.0<6.2.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2017-14589?
CVE-2017-14589 is a vulnerability that allowed for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur.
What is the severity of CVE-2017-14589?
CVE-2017-14589 has a severity rating of 9.6 (critical).
How does CVE-2017-14589 affect Atlassian Bamboo?
CVE-2017-14589 affects Atlassian Bamboo versions up to and including 6.1.6, as well as versions between 6.2.0 and 6.2.5 (exclusive).
How can an attacker exploit CVE-2017-14589?
An attacker with restricted administration rights to Bamboo or who hosts a website that a Bamboo administrator visits can exploit CVE-2017-14589 to execute Java code of their choice.
Where can I find more information about CVE-2017-14589?
More information about CVE-2017-14589 can be found at the following references: [http://www.securityfocus.com/bid/102188](http://www.securityfocus.com/bid/102188), [https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.html](https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.html), [https://jira.atlassian.com/browse/BAM-18842](https://jira.atlassian.com/browse/BAM-18842).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/atlassian
- canonical/atlassian bamboo
- version/atlassian bamboo/6.2.0