Lucene search

K

Atlassian Bamboo Multiple Vulnerabilities

🗓️ 14 Dec 2017 00:00:00Reported by Copyright (C) 2017 Greenbone AGType 
openvas
 openvas
🔗 plugins.openvas.org👁 38 Views

Atlassian Bamboo Multiple Vulnerabilities affecting versions prior to 6.1.6 and 6.2.x. Vulnerabilities include remote code execution and argument injection

Show more
Related
Refs
Code
ReporterTitlePublishedViews
Family
0day.today
Atlassian Bamboo Code Execution / Argument Injection Vulnerabilities
3 Jan 201800:00
zdt
Atlassian
Argument injection in Mercurial repository handling - CVE-2017-14590
15 Nov 201722:54
atlassian
Atlassian
Argument injection in Mercurial repository handling - CVE-2017-14590
15 Nov 201722:54
atlassian
Tenable Nessus
Atlassian Bamboo 6.1.x < 6.1.6 / 6.2.x < 6.2.5 Incorrect Permission Check RCE
19 Dec 201700:00
nessus
CVE
CVE-2017-14589
13 Dec 201715:29
cve
CVE
CVE-2017-14590
13 Dec 201715:29
cve
NVD
CVE-2017-14589
13 Dec 201715:29
nvd
NVD
CVE-2017-14590
13 Dec 201715:29
nvd
Cvelist
CVE-2017-14590
13 Dec 201715:00
cvelist
Cvelist
CVE-2017-14589
13 Dec 201715:00
cvelist
Rows per page
# SPDX-FileCopyrightText: 2017 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:atlassian:bamboo";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.140603");
  script_version("2023-11-03T05:05:46+0000");
  script_tag(name:"last_modification", value:"2023-11-03 05:05:46 +0000 (Fri, 03 Nov 2023)");
  script_tag(name:"creation_date", value:"2017-12-14 12:10:23 +0700 (Thu, 14 Dec 2017)");
  script_tag(name:"cvss_base", value:"9.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2019-10-03 00:03:00 +0000 (Thu, 03 Oct 2019)");

  script_cve_id("CVE-2017-14589", "CVE-2017-14590");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Atlassian Bamboo Multiple Vulnerabilities");

  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2017 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_atlassian_bamboo_detect.nasl");
  script_mandatory_keys("AtlassianBamboo/Installed");

  script_tag(name:"summary", value:"Atlassian Bamboo is prone to multiple vulnerabilities.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"Atlassian Bamboo is prone to multiple vulnerabilities:

  - Remote code execution through OGNL double evaluation (CVE-2017-14589)

  - Argument injection through Mercurial repository handling (CVE-2017-14590)");

  script_tag(name:"affected", value:"Atlassiona Bamboo versions prior to 6.1.6 and 6.2.x.");

  script_tag(name:"solution", value:"Update to 6.1.6, 6.2.5 or later.");

  script_xref(name:"URL", value:"https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.html");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (!port = get_app_port(cpe: CPE))
  exit(0);

if (!version = get_app_version(cpe: CPE, port: port))
  exit(0);

if (version_is_less(version: version, test_version: "6.1.6")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "6.1.6");
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range(version: version, test_version: "6.2.0", test_version2: "6.2.4")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "6.2.5");
  security_message(port: port, data: report);
  exit(0);
}

exit(0);

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
14 Dec 2017 00:00Current
9.4High risk
Vulners AI Score9.4
CVSS29
CVSS39.1
EPSS0.006
38
.json
Report