Atlassian Bamboo Data Center/Bamboo Server up to 9.6.3 file inclusion

Summaryinfo

A vulnerability has been found in Atlassian Bamboo Data Center and Bamboo Server up to 9.6.3 and classified as very critical. This issue affects some unknown processing. The manipulation leads to file inclusion. This vulnerability is referenced as CVE-2024-21687. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Atlassian Bamboo Data Center and Bamboo Server up to 9.6.3 and classified as very critical. This issue affects an unknown part. The manipulation with an unknown input leads to a file inclusion vulnerability. Using CWE to declare the problem leads to CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

This High severity File Inclusion vulnerability was introduced in versions 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 and 9.6.0 of Bamboo Data Center and Server. This File Inclusion vulnerability, with a CVSS Score of 8.1, allows an authenticated attacker to get the application to display the contents of a local file, or execute a different files already stored locally on the server which has high impact to confidentiality, high impact to integrity, no impact to availability, and requires no user interaction. Atlassian recommends that Bamboo Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions listed on this CVE See the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center and Server from the download center (https://www.atlassian.com/software/bamboo/download-archives). This vulnerability was reported via our Bug Bounty program.

It is possible to read the advisory at confluence.atlassian.com. The identification of this vulnerability is CVE-2024-21687 since 01/01/2024. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/20/2025).

Upgrading to version 9.2.16 or 9.6.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Atlassian

Name

• Bamboo Data Center
• Bamboo Server

Version

• 9.1.0
• 9.1.1
• 9.1.2
• 9.1.3
• 9.2.0
• 9.2.1
• 9.2.2
• 9.2.3
• 9.2.4
• 9.2.5
• 9.2.6
• 9.2.7
• 9.2.8
• 9.2.9
• 9.2.10
• 9.2.11
• 9.2.12
• 9.2.13
• 9.2.14
• 9.2.15
• 9.3.0
• 9.3.1
• 9.3.2
• 9.3.3
• 9.3.4
• 9.3.5
• 9.3.6
• 9.4.0
• 9.4.1
• 9.4.2
• 9.4.3
• 9.4.4
• 9.5.0
• 9.5.1
• 9.5.2
• 9.5.3
• 9.5.4
• 9.6.0
• 9.6.1
• 9.6.2
• 9.6.3

License

• free

Website

• Vendor: https://www.atlassian.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion