Double OGNL Evaluation in FreeMarker Templates for Atlassian Bamboo

CVE-2017-14589

What is CVE-2017-14589?

This vulnerability allows an attacker with limited administrative rights on Atlassian Bamboo to exploit double OGNL evaluation in FreeMarker templates. If an administrator visits a malicious website, the attacker could execute arbitrary Java code on the targeted systems running vulnerable versions of Bamboo. The issue affects all versions of Bamboo prior to 6.1.6 and from versions 6.2.0 to before 6.2.5.

References