CVE-2017-8907

Published: Jun 14, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.

Affected (53)

Products: Atlassian: Bamboo

Atlassian

1 product

Bamboo

Configuration A

53 vulnerable

Vulnerable Software	Affected Versions
Atlassian Bamboo	Version 5.0.1
Atlassian Bamboo	Version 5.0
Atlassian Bamboo	Version 5.0 beta1
Atlassian Bamboo	Version 5.0 beta2
Atlassian Bamboo	Version 5.0 beta3
Atlassian Bamboo	Version 5.0 rc1
Atlassian Bamboo	Version 5.1.1
Atlassian Bamboo	Version 5.11.3
Atlassian Bamboo	Version 5.12.0
Atlassian Bamboo	Version 5.12.1
Atlassian Bamboo	Version 5.12.2
Atlassian Bamboo	Version 5.12.4
Atlassian Bamboo	Version 5.12.5
Atlassian Bamboo	Version 5.13.0
Atlassian Bamboo	Version 5.13.1
Atlassian Bamboo	Version 5.13.2
Atlassian Bamboo	Version 5.14.0
Atlassian Bamboo	Version 5.14.1
Atlassian Bamboo	Version 5.14.2
Atlassian Bamboo	Version 5.14.3
Atlassian Bamboo	Version 5.14.4.1
Atlassian Bamboo	Version 5.14.5
Atlassian Bamboo	Version 5.15.0
Atlassian Bamboo	Version 5.15.2
Atlassian Bamboo	Version 5.15.3
Atlassian Bamboo	Version 5.15.4
Atlassian Bamboo	Version 5.15.5
Atlassian Bamboo	Version 5.1
Atlassian Bamboo	Version 5.2.1
Atlassian Bamboo	Version 5.2.2
Atlassian Bamboo	Version 5.2
Atlassian Bamboo	Version 5.3
Atlassian Bamboo	Version 5.4.1
Atlassian Bamboo	Version 5.4.2
Atlassian Bamboo	Version 5.4
Atlassian Bamboo	Version 5.5
Atlassian Bamboo	Version 5.6.1
Atlassian Bamboo	Version 5.6.2
Atlassian Bamboo	Version 5.6
Atlassian Bamboo	Version 5.7.1
Atlassian Bamboo	Version 5.7.2
Atlassian Bamboo	Version 5.7
Atlassian Bamboo	Version 5.8.1
Atlassian Bamboo	Version 5.8.2
Atlassian Bamboo	Version 5.8.5
Atlassian Bamboo	Version 5.8
Atlassian Bamboo	Version 5.9.1
Atlassian Bamboo	Version 5.9.2
Atlassian Bamboo	Version 5.9.3
Atlassian Bamboo	Version 5.9.4
Atlassian Bamboo	Version 5.9.7
Atlassian Bamboo	Version 5.9
Atlassian Bamboo	Version 6.0.0