Atlassian Bamboo vulnerabilities
28 known vulnerabilities affecting atlassian/bamboo.
Total CVEs
28
CISA KEV
1
actively exploited
Public exploits
2
Exploited in wild
1
Severity breakdown
CRITICAL8HIGH14MEDIUM6
Vulnerabilities
Page 2 of 2
CVE-2017-18042P3HIGHCVSS 8.8fixed in 6.3.1vprior to 6.3.12018-02-02
CVE-2017-18042 [HIGH] CWE-352 CVE-2017-18042: The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attac
The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-site request forgery (CSRF) vulnerability.
nvd
CVE-2017-18080P4HIGHCVSS 8.8fixed in 6.3.1vprior to 6.3.12018-02-02
CVE-2017-18080 [HIGH] CWE-352 CVE-2017-18080: The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers
The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross-site request forgery (CSRF) vulnerability.
nvd
CVE-2021-26067P4MEDIUMCVSS 5.3fixed in 7.2.2≥ unspecified, < 7.2.22021-01-28
CVE-2021-26067 [MEDIUM] CWE-200 CVE-2021-26067: Affected versions of Atlassian Bamboo allow an unauthenticated remote attacker to view a stack trace
Affected versions of Atlassian Bamboo allow an unauthenticated remote attacker to view a stack trace that may reveal the path for the home directory in disk and if certain files exists on the tmp directory, via a Sensitive Data Exposure vulnerability in the /chart endpoint. The affected versions are before version 7.2.2.
nvd
CVE-2019-15005P4MEDIUMCVSS 4.3fixed in 6.10.2≥ unspecified, < 6.10.22019-11-08
CVE-2019-15005 [MEDIUM] CWE-862 CVE-2019-15005: The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivilege
The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulne
nvd
CVE-2017-18081P4MEDIUMCVSS 6.1fixed in 6.3.1vprior to 6.3.12018-02-02
CVE-2017-18081 [MEDIUM] CWE-79 CVE-2017-18081: The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject a
The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the value of the csrf token cookie.
nvd
CVE-2017-18041P4MEDIUMCVSS 5.4fixed in 6.2.0vprior to 6.2.02018-02-02
CVE-2017-18041 [MEDIUM] CWE-79 CVE-2017-18041: The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows r
The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a release.
nvd
CVE-2017-18040P4MEDIUMCVSS 5.4fixed in 6.2vprior to 6.2.02018-02-02
CVE-2017-18040 [MEDIUM] CWE-79 CVE-2017-18040: The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote att
The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a release.
nvd
CVE-2017-18082P4MEDIUMCVSS 5.4fixed in 6.2.3vprior to 6.2.32018-02-02
CVE-2017-18082 [MEDIUM] CWE-79 CVE-2017-18082: The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attacker
The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a branch.
nvd
← Previous2 / 2