Cross-Site Scripting Flaw in Atlassian Bamboo
CVE-2017-18081

6.1MEDIUM

Key Information:

Vendor
Atlassian
Status
Bamboo
Vendor
CVE Published:
2 February 2018

Summary

The signupUser resource in Atlassian Bamboo before version 6.3.1 is susceptible to a cross-site scripting (XSS) vulnerability. This flaw allows remote attackers to inject malicous HTML or JavaScript through manipulation of the csrf token cookie value, potentially compromising user sessions and the integrity of the application. It is vital for users to upgrade to the latest version to mitigate these risks.

Affected Version(s)

Bamboo prior to 6.3.1

References

https://jira.atlassian.com/browse/BAM-19665
x_refsource_CONFIRM
http://www.securityfocus.com/bid/103087
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.