| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| bamboo | = 5.0= 5.0.1= 5.1= 5.1.1= 5.11.3= 5.12.0= 5.12.1= 5.12.2= 5.12.4= 5.12.5= 5.13.0= 5.13.1= 5.13.2= 5.14.0= 5.14.1= 5.14.2= 5.14.3= 5.14.4.1= 5.14.5= 5.15.0= 5.15.2= 5.15.3= 5.15.4= 5.15.5= 5.2= 5.2.1= 5.2.2= 5.3= 5.4= 5.4.1= 5.4.2= 5.5= 5.6= 5.6.1= 5.6.2= 5.7= 5.7.1= 5.7.2= 5.8= 5.8.1= 5.8.2= 5.8.5= 5.9= 5.9.1= 5.9.2= 5.9.3= 5.9.4= 5.9.7= 6.0.0 |
Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン