CVE-2017-8907
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.
Atlassian Bamboo, en versiones 5.x anteriores a la 5.15.7 y versiones 6.x anteriores a la 6.0.1, no comprobó correctamente si un usuario que crea un proyecto de despliegue tenía el permiso de edición y, por lo tanto, los derechos para hacerlo. Un atacante que pueda iniciar sesión en Bamboo como usuario sin el permiso de edición para proyectos de despliegue puede emplear esta vulnerabilidad, siempre y cuando exista un plan con un "green build" para crear un proyecto de despliegue y ejecute código arbitrario en un agente Bamboo disponible. Por defecto, un agente local está habilitado.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2017-05-12 CVE Reserved
- 2017-06-14 CVE Published
- 2024-01-16 EPSS Updated
- 2024-10-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-863: Incorrect Authorization
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/99090 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-06-14-907283498.html | 2019-10-03 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.0 Search vendor "Atlassian" for product "Bamboo" and version "5.0" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.0 Search vendor "Atlassian" for product "Bamboo" and version "5.0" | beta1 |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.0 Search vendor "Atlassian" for product "Bamboo" and version "5.0" | beta2 |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.0 Search vendor "Atlassian" for product "Bamboo" and version "5.0" | beta3 |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.0 Search vendor "Atlassian" for product "Bamboo" and version "5.0" | rc1 |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.0.1 Search vendor "Atlassian" for product "Bamboo" and version "5.0.1" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.1 Search vendor "Atlassian" for product "Bamboo" and version "5.1" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.1.1 Search vendor "Atlassian" for product "Bamboo" and version "5.1.1" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.2 Search vendor "Atlassian" for product "Bamboo" and version "5.2" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.2.1 Search vendor "Atlassian" for product "Bamboo" and version "5.2.1" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.2.2 Search vendor "Atlassian" for product "Bamboo" and version "5.2.2" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.3 Search vendor "Atlassian" for product "Bamboo" and version "5.3" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.4 Search vendor "Atlassian" for product "Bamboo" and version "5.4" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.4.1 Search vendor "Atlassian" for product "Bamboo" and version "5.4.1" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.4.2 Search vendor "Atlassian" for product "Bamboo" and version "5.4.2" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.5 Search vendor "Atlassian" for product "Bamboo" and version "5.5" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.6 Search vendor "Atlassian" for product "Bamboo" and version "5.6" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.6.1 Search vendor "Atlassian" for product "Bamboo" and version "5.6.1" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.6.2 Search vendor "Atlassian" for product "Bamboo" and version "5.6.2" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.7 Search vendor "Atlassian" for product "Bamboo" and version "5.7" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.7.1 Search vendor "Atlassian" for product "Bamboo" and version "5.7.1" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.7.2 Search vendor "Atlassian" for product "Bamboo" and version "5.7.2" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.8 Search vendor "Atlassian" for product "Bamboo" and version "5.8" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.8.1 Search vendor "Atlassian" for product "Bamboo" and version "5.8.1" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.8.2 Search vendor "Atlassian" for product "Bamboo" and version "5.8.2" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.8.5 Search vendor "Atlassian" for product "Bamboo" and version "5.8.5" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.9 Search vendor "Atlassian" for product "Bamboo" and version "5.9" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.9.1 Search vendor "Atlassian" for product "Bamboo" and version "5.9.1" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.9.2 Search vendor "Atlassian" for product "Bamboo" and version "5.9.2" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.9.3 Search vendor "Atlassian" for product "Bamboo" and version "5.9.3" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.9.4 Search vendor "Atlassian" for product "Bamboo" and version "5.9.4" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.9.7 Search vendor "Atlassian" for product "Bamboo" and version "5.9.7" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.11.3 Search vendor "Atlassian" for product "Bamboo" and version "5.11.3" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.12.0 Search vendor "Atlassian" for product "Bamboo" and version "5.12.0" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.12.1 Search vendor "Atlassian" for product "Bamboo" and version "5.12.1" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.12.2 Search vendor "Atlassian" for product "Bamboo" and version "5.12.2" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.12.4 Search vendor "Atlassian" for product "Bamboo" and version "5.12.4" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.12.5 Search vendor "Atlassian" for product "Bamboo" and version "5.12.5" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.13.0 Search vendor "Atlassian" for product "Bamboo" and version "5.13.0" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.13.1 Search vendor "Atlassian" for product "Bamboo" and version "5.13.1" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.13.2 Search vendor "Atlassian" for product "Bamboo" and version "5.13.2" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.14.0 Search vendor "Atlassian" for product "Bamboo" and version "5.14.0" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.14.1 Search vendor "Atlassian" for product "Bamboo" and version "5.14.1" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.14.2 Search vendor "Atlassian" for product "Bamboo" and version "5.14.2" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.14.3 Search vendor "Atlassian" for product "Bamboo" and version "5.14.3" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.14.4.1 Search vendor "Atlassian" for product "Bamboo" and version "5.14.4.1" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.14.5 Search vendor "Atlassian" for product "Bamboo" and version "5.14.5" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.15.0 Search vendor "Atlassian" for product "Bamboo" and version "5.15.0" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.15.2 Search vendor "Atlassian" for product "Bamboo" and version "5.15.2" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.15.3 Search vendor "Atlassian" for product "Bamboo" and version "5.15.3" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.15.4 Search vendor "Atlassian" for product "Bamboo" and version "5.15.4" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 5.15.5 Search vendor "Atlassian" for product "Bamboo" and version "5.15.5" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Bamboo Search vendor "Atlassian" for product "Bamboo" | 6.0.0 Search vendor "Atlassian" for product "Bamboo" and version "6.0.0" | - |
Affected
| ||||||