CVE-2017-14589: Input Validation
It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted administration rights to Bamboo or who hosts a website that a Bamboo administrator visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Bamboo. All versions of Bamboo before 6.1.6 (the fixed version for 6.1.x) and from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) are affected by this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-14589?
CVE-2017-14589 is a vulnerability that allowed for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur.
What is the severity of CVE-2017-14589?
CVE-2017-14589 has a severity rating of 9.6 (critical).
How does CVE-2017-14589 affect Atlassian Bamboo?
CVE-2017-14589 affects Atlassian Bamboo versions up to and including 6.1.6, as well as versions between 6.2.0 and 6.2.5 (exclusive).
How can an attacker exploit CVE-2017-14589?
An attacker with restricted administration rights to Bamboo or who hosts a website that a Bamboo administrator visits can exploit CVE-2017-14589 to execute Java code of their choice.
Where can I find more information about CVE-2017-14589?
More information about CVE-2017-14589 can be found at the following references: [http://www.securityfocus.com/bid/102188](http://www.securityfocus.com/bid/102188), [https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.html](https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.html), [https://jira.atlassian.com/browse/BAM-18842](https://jira.atlassian.com/browse/BAM-18842).