« Volver al listado

CVE-2017-9514

Estado: ModificadaAlta (8.8)—

Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. An attacker who can log in to Bamboo as a user is able to exploit this vulnerability to execute Java code of their choice on systems that have vulnerable versions of Bamboo.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Atlassian — Bamboo

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-9514",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@atlassian.com",
      "affectedData": [
        {
          "vendor": "Atlassian",
          "product": "Bamboo",
          "versions": [
            {
              "status": "affected",
              "version": "from 6.0.0 before 6.0.5"
            },
            {
              "status": "affected",
              "version": "from 6.1.0 before 6.1.4"
            },
            {
              "status": "affected",
              "version": "from 6.2.0 before 6.2.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-10-12T13:29:00.200",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/101269",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-10-11-938843921.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/101269",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-10-11-938843921.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. An attacker who can log in to Bamboo as a user is able to exploit this vulnerability to execute Java code of their choice on systems that have vulnerable versions of Bamboo."
    },
    {
      "lang": "es",
      "value": "Bamboo en versiones anteriores a la 6.0.5, 6.1.x anteriores a la 6.1.4 y 6.2.x anteriores a la 6.2.1 tenía un endpoint REST que analizaba sintácticamente un archivo YAML y no restringía suficientemente qué clases se podían cargar. Un atacante que pueda iniciar sesión en Bamboo como un usuario sería capaz de explotar esta vulnerabilidad para ejecutar código Java de su elección en sistemas que tienen versiones vulnerables de Bamboo."
    }
  ],
  "lastModified": "2026-06-17T01:28:16.813",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:bamboo:6.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1DACC3EE-5898-457C-B9FE-DCBA2634DE4F"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bamboo:6.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67BEBCA5-8704-4557-8119-AF4C0799394E"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bamboo:6.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "451870E0-326D-424F-86E9-B04A177B7D6F"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bamboo:6.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79E39376-B888-40C9-9DC6-036D5C573823"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bamboo:6.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09F1CF26-C2CA-4BEB-B3E1-45B280FE4F9E"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bamboo:6.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "374EF21B-238E-4173-AABB-771B4CC636B1"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bamboo:6.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83D8E6A7-EA13-474B-B7DD-3EC9F05438D3"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bamboo:6.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA5E64B2-EA6A-433A-ACF7-540F8273CFE8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@atlassian.com"
}