Vulnerability Intelligence Report
CVE-2017-14589
It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted administration rights to Bamboo or who hosts a website that a Bamboo administrator visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Bamboo. All versions of Bamboo before 6.1.6 (the fixed version for 6.1.x) and from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) are affected by this vulnerability.
No Active Exploit Signals
CVSS Base Score
9.6
CRITICAL
EPSS Probability:1.87%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Atlassian | Bamboo | before 6.1.6 (the fixed version for 6.1.x) (affected), from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
1.873%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Atlassian · Vendor · Australia |
| Reserved | 2017-09-19T00:00:00 |
| Published | 2017-12-13T15:00:00 |
| Patch Date | 2017-12-12 |
| Last Updated | 2024-09-16T19:10:55 |
Community Chatter & Buzz