CVE-2023-22506: Code Injection
First published: Wed Jul 19 2023(Updated: )
This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo Data Center. This Injection and RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.5, allows an authenticated attacker to modify the actions taken by a system call and execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction. Atlassian recommends that you upgrade your instance to latest version. If you're unable to upgrade to latest, upgrade to one of these fixed versions: 9.2.3 and 9.3.1. See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html|https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Bamboo Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives|https://www.atlassian.com/software/bamboo/download-archives]). This vulnerability was reported via our Penetration Testing program.
Credit: security@atlassian.com security@atlassian.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Atlassian Bamboo Data Center | >=8.0.0<9.2.3 | |
| Atlassian Bamboo Server | >=8.0.0<9.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-22506?
CVE-2023-22506 is a high severity Injection and RCE (Remote Code Execution) vulnerability in Atlassian Bamboo Data Center and Bamboo Server.
What is the severity of CVE-2023-22506?
CVE-2023-22506 has a severity score of 8.8, which is considered high.
How does CVE-2023-22506 affect Atlassian Bamboo Data Center and Bamboo Server?
CVE-2023-22506 affects versions 8.0.0 to 9.2.3 of Atlassian Bamboo Data Center and Bamboo Server, allowing an authenticated attacker to modify actions.
What is the Common Vulnerabilities and Exposures (CVE) ID for this vulnerability?
The Common Vulnerabilities and Exposures (CVE) ID for this vulnerability is CVE-2023-22506.
How can I fix CVE-2023-22506?
To fix CVE-2023-22506, update Atlassian Bamboo Data Center and Bamboo Server to a version higher than 9.2.3.
- collector/nvd-latest
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/remedy
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- vendor/atlassian
- canonical/atlassian bamboo data center
- version/atlassian bamboo data center/8.0.0
- canonical/atlassian bamboo server
- version/atlassian bamboo server/8.0.0