CVE-2017-14589

It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted administration rights to Bamboo or who hosts a website that a Bamboo administrator visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Bamboo. All versions of Bamboo before 6.1.6 (the fixed version for 6.1.x) and from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) are affected by this vulnerability.

• CWE-20

• http://www.securityfocus.com/bid/102188Third Party Advisory, VDB Entry
• https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.htmlVendor Advisory
• https://jira.atlassian.com/browse/BAM-18842Issue Tracking, Vendor Advisory
• http://www.securityfocus.com/bid/102188Third Party Advisory, VDB Entry
• https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.htmlVendor Advisory
• https://jira.atlassian.com/browse/BAM-18842Issue Tracking, Vendor Advisory

Published

Dec 13, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14582The Zoho Site24x7 Mobile Network Poller application before 1…
• CVE-2017-14583NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and…
• CVE-2017-14585A Server Side Request Forgery (SSRF) vulnerability could lea…
• CVE-2017-14586The Hipchat for Mac desktop client is vulnerable to client-s…9.8
• CVE-2017-14587The administration user deletion resource in Atlassian Fishe…
• CVE-2017-14588Various resources in Atlassian Fisheye and Crucible before v…
• CVE-2017-1459IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specif…
• CVE-2017-14590Bamboo did not check that the name of a branch in a Mercuria…
• CVE-2017-14591Atlassian Fisheye and Crucible versions less than 4.4.3 and …
• CVE-2017-14592Sourcetree for macOS had several argument and command inject…
• CVE-2017-14593Sourcetree for Windows had several argument and command inje…
• CVE-2017-14594The printable searchrequest issue resource in Atlassian Jira…