CVE-2017-9514

Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. An attacker who can log in to Bamboo as a user is able to exploit this vulnerability to execute Java code of their choice on systems that have vulnerable versions of Bamboo.

• CWE-732

• http://www.securityfocus.com/bid/101269Third Party Advisory, VDB Entry
• https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-10-11-938843921.htmlVendor Advisory
• http://www.securityfocus.com/bid/101269Third Party Advisory, VDB Entry
• https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-10-11-938843921.htmlVendor Advisory

Published

Oct 12, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9508Various resources in Atlassian Fisheye and Crucible before v…
• CVE-2017-9509The review file upload resource in Atlassian Crucible before…
• CVE-2017-9510The repository changelog resource in Atlassian Fisheye befor…
• CVE-2017-9511The MultiPathResource class in Atlassian Fisheye and Crucibl…7.5
• CVE-2017-9512The mostActiveCommitters.do resource in Atlassian Fisheye an…7.5
• CVE-2017-9513Several rest inline action resources of Atlassian Activity S…
• CVE-2017-9516Craft CMS before 2.6.2982 allows for a potential XSS attack …
• CVE-2017-9517atmail before 7.8.0.2 has CSRF, allowing an attacker to uplo…
• CVE-2017-9518atmail before 7.8.0.2 has CSRF, allowing an attacker to chan…
• CVE-2017-9519atmail before 7.8.0.2 has CSRF, allowing an attacker to crea…
• CVE-2017-9520The r_config_set function in libr/config/config.c in radare2…
• CVE-2017-9521The Comcast firmware on Cisco DPC3939 (firmware version dpc3…9.8