CVE-2017-9514

Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes…

published October 12, 2017

CVSS
—
EPSS
1%
Percentile
63.7
In the wild
Unconfirmed
What it is

Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. An attacker who can log in to Bamboo as a user is able to exploit this vulnerability to execute Java code of their choice on systems that have vulnerable versions of Bamboo.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01046 · 63.7th percentile
Published
2017-10-12T13:00Z
EPSS history
Timeline
  • 12 OCT 13:00Z
    Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes…
    cvelistv5