CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-22516
https://notcve.org/view.php?id=CVE-2023-22516
This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.0, and 9.3.0 of Bamboo Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Bamboo Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Bamboo Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7. JDK 1.8u121+ should be used in case Java 8 used to run Bamboo Data Center and Server. See Bamboo 9.2 Upgrade notes (https://confluence.atlassian.com/bambooreleases/bamboo-9-2-upgrade-notes-1207179212.html) Bamboo Data Center and Server 9.3: Upgrade to a release greater than or equal to 9.3.4 See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives]). This vulnerability was discovered by a private user and reported via our Bug Bounty program Esta vulnerabilidad RCE (ejecución remota de código) de alta gravedad se introdujo en las versiones 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.0 y 9.3.0 de Bamboo Data Center and Server. Esta vulnerabilidad RCE (ejecución remota de código), con una puntuación CVSS de 8.5, permite a un atacante autenticado ejecutar código arbitrario que tiene un alto impacto en la confidencialidad, un alto impacto en la integridad, un alto impacto en la disponibilidad y no requiere interacción del usuario. Atlassian recomienda que los clientes de Bamboo Data Center and Server actualicen a la última versión; si no puede hacerlo, actualice su instancia a una de las versiones fijas admitidas especificadas: Bamboo Data Center and Server 9.2: actualice a una versión superior o igual a 9.2.7. • https://confluence.atlassian.com/pages/viewpage.action?pageId=1318881573 https://jira.atlassian.com/browse/BAM-25168 •
CVSS: 8.8EPSS: 0%CPEs: 42EXPL: 0CVE-2022-26137
https://notcve.org/view.php?id=CVE-2022-26137
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. • https://jira.atlassian.com/browse/BAM-21795 https://jira.atlassian.com/browse/BSERV-13370 https://jira.atlassian.com/browse/CONFSERVER-79476 https://jira.atlassian.com/browse/CRUC-8541 https://jira.atlassian.com/browse/CWD-5815 https://jira.atlassian.com/browse/FE-7410 https://jira.atlassian.com/browse/JRASERVER-73897 https://jira.atlassian.com/browse/JSDSERVER-11863 • CWE-180: Incorrect Behavior Order: Validate Before Canonicalize CWE-346: Origin Validation Error •
CVSS: 9.8EPSS: 0%CPEs: 42EXPL: 0CVE-2022-26136
https://notcve.org/view.php?id=CVE-2022-26136
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. • https://jira.atlassian.com/browse/BAM-21795 https://jira.atlassian.com/browse/BSERV-13370 https://jira.atlassian.com/browse/CONFSERVER-79476 https://jira.atlassian.com/browse/CRUC-8541 https://jira.atlassian.com/browse/CWD-5815 https://jira.atlassian.com/browse/FE-7410 https://jira.atlassian.com/browse/JRASERVER-73897 https://jira.atlassian.com/browse/JSDSERVER-11863 • CWE-180: Incorrect Behavior Order: Validate Before Canonicalize CWE-287: Improper Authentication •