CVE-2018-5224

8.8HIGH

Key Information:

Vendor
Atlassian
Status
Bamboo
Vendor
CVE Published:
29 March 2018

Summary

Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to create a repository in Bamboo, edit an existing plan in Bamboo that has a non-linked Mercurial repository, or create a plan in Bamboo either globally or in a project using Bamboo Specs can can execute code of their choice on systems that run a vulnerable version of Bamboo on the Windows operating system. All versions of Bamboo starting with 2.7.0 before 6.3.3 (the fixed version for 6.3.x) and from version 6.4.0 before 6.4.1 (the fixed version for 6.4.x) running on the Windows operating system are affected by this vulnerability.

Affected Version(s)

Bamboo 2.7.1

Bamboo < 6.3.3

Bamboo 6.4.0

References

http://www.securityfocus.com/bid/103653
vdb-entryx_refsource_BID
https://jira.atlassian.com/browse/BAM-19743
x_refsource_CONFIRM
https://confluence.atlassian.com/x/PS9sO
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.