CVE-2017-14590: Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who has permission to create a rep...

Description

Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who has permission to create a repository in Bamboo, edit an existing plan that has a non-linked Mercurialrepository, create or edit a plan when there is at least one linked Mercurial repository that the attacker has permission to use, or commit to a Mercurial repository used by a Bamboo plan which has branch detection enabled can execute code of their choice on systems that run a vulnerable version of Bamboo Server. Versions of Bamboo starting with 2.7.0 before 6.1.6 (the fixed version for 6.1.x) and from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) are affected by this vulnerability.

Metrics

EPSS Probability

2.40%

82.0th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Vendor	Product	Versions
Atlassian	Bamboo	>= 2.7.0, < 6.1.6
Atlassian	Bamboo	>= 6.2.0, < 6.2.5

References

http://www.securityfocus.com/bid/102193Third Party Advisory, VDB Entry
https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.htmlPatch, Vendor Advisory
https://jira.atlassian.com/browse/BAM-18843Issue Tracking, Patch, Vendor Advisory
http://www.securityfocus.com/bid/102193Third Party Advisory, VDB Entry
https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.htmlPatch, Vendor Advisory
https://jira.atlassian.com/browse/BAM-18843Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Dec 13, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-14590?

Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who has permission to create a repository in Bamboo, edit an existing plan that has a non-linked Mercurialrepository, create or edit a plan when there is at least one linked Mercurial repository that the attacker has permission to use, or commit to a Mercurial repository used by a Bamboo plan which has branch detection enabled can execute code of their choice on systems that run a vulnerable version of Bamboo Server. Versions of Bamboo starting with 2.7.0 before 6.1.6 (the fixed version for 6.1.x) and from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) are affected by this vulnerability.

How severe is CVE-2017-14590?

Severity scoring for CVE-2017-14590 is pending analysis. The EPSS model estimates a 2.40% probability of exploitation in the next 30 days.

How do I fix CVE-2017-14590?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2017

View all 2017CVEs →