cvelistv5 - CVE-2024-21689

CVE-2024-21689 (GCVE-0-2024-21689)

Vulnerability from cvelistv5 – Published: 2024-08-20 10:00 – Updated: 2025-03-13 15:46

Summary

This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Bamboo Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Bamboo Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.17 Bamboo Data Center and Server 9.6: Upgrade to a release greater than or equal to 9.6.5 See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives]). This vulnerability was reported via our Bug Bounty program.

Severity ?

7.6 (High)


                        
                          CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

CWE

RCE (Remote Code Execution)

Assigner

atlassian

References

URL

Tags

	https://confluence.atlassian.com/pages/viewpage.a…
	https://jira.atlassian.com/browse/BAM-25858

Impacted products

Vendor

Product

Version

Atlassian

Bamboo Data Center

Affected: 9.6.0 to 9.6.4
Affected: 9.5.0 to 9.5.4
Affected: 9.4.0 to 9.4.4
Affected: 9.3.0 to 9.3.6
Affected: 9.2.1 to 9.2.16
Affected: 9.1.0 to 9.1.3
Unaffected: 9.6.5
Unaffected: 9.2.17

Atlassian

Bamboo Server

Affected: 9.4.0 to 9.4.4
Affected: 9.3.0 to 9.3.6
Affected: 9.2.1 to 9.2.16
Affected: 9.1.0 to 9.1.3
Unaffected: 9.2.17

Credits

Bug Bounty

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:atlassian:bamboo_data_center:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "bamboo_data_center",
            "vendor": "atlassian",
            "versions": [
              {
                "lessThan": "9.6.4",
                "status": "affected",
                "version": "9.6.0",
                "versionType": "custom"
              },
              {
                "lessThan": "9.5.4",
                "status": "affected",
                "version": "9.5.0",
                "versionType": "custom"
              },
              {
                "lessThan": "9.4.4",
                "status": "affected",
                "version": "9.4.0",
                "versionType": "custom"
              },
              {
                "lessThan": "9.3.6",
                "status": "affected",
                "version": "9.3.0",
                "versionType": "custom"
              },
              {
                "lessThan": "9.2.16",
                "status": "affected",
                "version": "9.2.1",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.3",
                "status": "affected",
                "version": "9.1.0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "9.6.5"
              },
              {
                "status": "unaffected",
                "version": "9.2.17"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:atlassian:bamboo_server:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "bamboo_server",
            "vendor": "atlassian",
            "versions": [
              {
                "lessThan": "9.4.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "9.3.6",
                "status": "affected",
                "version": "9.3.0",
                "versionType": "custom"
              },
              {
                "lessThan": "9.2.16",
                "status": "affected",
                "version": "9.2.1",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.3",
                "status": "affected",
                "version": "9.1.0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "9.2.17"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21689",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-27T03:55:20.295438Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T15:46:54.670Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Bamboo Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "9.6.0 to 9.6.4"
            },
            {
              "status": "affected",
              "version": "9.5.0 to 9.5.4"
            },
            {
              "status": "affected",
              "version": "9.4.0 to 9.4.4"
            },
            {
              "status": "affected",
              "version": "9.3.0 to 9.3.6"
            },
            {
              "status": "affected",
              "version": "9.2.1 to 9.2.16"
            },
            {
              "status": "affected",
              "version": "9.1.0 to 9.1.3"
            },
            {
              "status": "unaffected",
              "version": "9.6.5"
            },
            {
              "status": "unaffected",
              "version": "9.2.17"
            }
          ]
        },
        {
          "product": "Bamboo Server",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "9.4.0 to 9.4.4"
            },
            {
              "status": "affected",
              "version": "9.3.0 to 9.3.6"
            },
            {
              "status": "affected",
              "version": "9.2.1 to 9.2.16"
            },
            {
              "status": "affected",
              "version": "9.1.0 to 9.1.3"
            },
            {
              "status": "unaffected",
              "version": "9.2.17"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Bug Bounty"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689\u00a0 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server.\r\n\r\nThis RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.\r\n\r\nAtlassian recommends that Bamboo Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Bamboo Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.17\r\n\r\n Bamboo Data Center and Server 9.6: Upgrade to a release greater than or equal to 9.6.5\r\n\r\nSee the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).\r\n\r\nThis vulnerability was reported via our Bug Bounty program."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "RCE (Remote Code Execution)",
              "lang": "en",
              "type": "RCE (Remote Code Execution)"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-20T10:00:00.967Z",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1431535667"
        },
        {
          "url": "https://jira.atlassian.com/browse/BAM-25858"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2024-21689",
    "datePublished": "2024-08-20T10:00:00.967Z",
    "dateReserved": "2024-01-01T00:05:33.847Z",
    "dateUpdated": "2025-03-13T15:46:54.670Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689\\u00a0 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server.\\r\\n\\r\\nThis RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.\\r\\n\\r\\nAtlassian recommends that Bamboo Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\\r\\n Bamboo Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.17\\r\\n\\r\\n Bamboo Data Center and Server 9.6: Upgrade to a release greater than or equal to 9.6.5\\r\\n\\r\\nSee the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).\\r\\n\\r\\nThis vulnerability was reported via our Bug Bounty program.\"}, {\"lang\": \"es\", \"value\": \"Esta vulnerabilidad de ejecuci\\u00f3n remota de c\\u00f3digo (RCE) de alta gravedad, CVE-2024-21689, se introdujo en las versiones 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 y 9.6.0 de Bamboo Data Center and Server. Esta vulnerabilidad de ejecuci\\u00f3n remota de c\\u00f3digo (RCE), con una puntuaci\\u00f3n CVSS de 7,6, permite a un atacante autenticado ejecutar c\\u00f3digo arbitrario que tiene un alto impacto en la confidencialidad, la integridad y la disponibilidad, y requiere la interacci\\u00f3n del usuario. Atlassian recomienda que los clientes de Bamboo Data Center and Server actualicen a la \\u00faltima versi\\u00f3n. Si no puede hacerlo, actualice su instancia a una de las versiones corregidas compatibles especificadas: Bamboo Data Center and Server 9.2: actualice a una versi\\u00f3n mayor o igual a 9.2.17 Bamboo Data Center and Server 9.6: actualice a una versi\\u00f3n mayor o igual a 9.6.5 Consulte las notas de la versi\\u00f3n ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). Puede descargar la \\u00faltima versi\\u00f3n de Bamboo Data Center and Server desde el centro de descargas ([https://www.atlassian.com/software/bamboo/download-archives]). Esta vulnerabilidad se inform\\u00f3 a trav\\u00e9s de nuestro programa Bug Bounty.\"}]",
      "id": "CVE-2024-21689",
      "lastModified": "2024-08-20T15:44:20.567",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"security@atlassian.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H\", \"baseScore\": 7.6, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 6.0}]}",
      "published": "2024-08-20T10:15:04.103",
      "references": "[{\"url\": \"https://confluence.atlassian.com/pages/viewpage.action?pageId=1431535667\", \"source\": \"security@atlassian.com\"}, {\"url\": \"https://jira.atlassian.com/browse/BAM-25858\", \"source\": \"security@atlassian.com\"}]",
      "sourceIdentifier": "security@atlassian.com",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-21689\",\"sourceIdentifier\":\"security@atlassian.com\",\"published\":\"2024-08-20T10:15:04.103\",\"lastModified\":\"2025-03-13T16:15:17.273\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689\u00a0 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server.\\r\\n\\r\\nThis RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.\\r\\n\\r\\nAtlassian recommends that Bamboo Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\\r\\n Bamboo Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.17\\r\\n\\r\\n Bamboo Data Center and Server 9.6: Upgrade to a release greater than or equal to 9.6.5\\r\\n\\r\\nSee the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).\\r\\n\\r\\nThis vulnerability was reported via our Bug Bounty program.\"},{\"lang\":\"es\",\"value\":\"Esta vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) de alta gravedad, CVE-2024-21689, se introdujo en las versiones 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 y 9.6.0 de Bamboo Data Center and Server. Esta vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE), con una puntuaci\u00f3n CVSS de 7,6, permite a un atacante autenticado ejecutar c\u00f3digo arbitrario que tiene un alto impacto en la confidencialidad, la integridad y la disponibilidad, y requiere la interacci\u00f3n del usuario. Atlassian recomienda que los clientes de Bamboo Data Center and Server actualicen a la \u00faltima versi\u00f3n. Si no puede hacerlo, actualice su instancia a una de las versiones corregidas compatibles especificadas: Bamboo Data Center and Server 9.2: actualice a una versi\u00f3n mayor o igual a 9.2.17 Bamboo Data Center and Server 9.6: actualice a una versi\u00f3n mayor o igual a 9.6.5 Consulte las notas de la versi\u00f3n ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). Puede descargar la \u00faltima versi\u00f3n de Bamboo Data Center and Server desde el centro de descargas ([https://www.atlassian.com/software/bamboo/download-archives]). Esta vulnerabilidad se inform\u00f3 a trav\u00e9s de nuestro programa Bug Bounty.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.1,\"impactScore\":5.9}],\"cvssMetricV30\":[{\"source\":\"security@atlassian.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.1.0\",\"versionEndExcluding\":\"9.2.17\",\"matchCriteriaId\":\"B5EC3F5F-AFF0-4FAD-AFC9-4BE967319F82\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.3.0\",\"versionEndExcluding\":\"9.6.5\",\"matchCriteriaId\":\"52F810C2-8E16-4B1A-B426-54CE82067349\"}]}]}],\"references\":[{\"url\":\"https://confluence.atlassian.com/pages/viewpage.action?pageId=1431535667\",\"source\":\"security@atlassian.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/BAM-25858\",\"source\":\"security@atlassian.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-21689\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-27T03:55:20.295438Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:atlassian:bamboo_data_center:*:*:*:*:*:*:*:*\"], \"vendor\": \"atlassian\", \"product\": \"bamboo_data_center\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.6.0\", \"lessThan\": \"9.6.4\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"9.5.0\", \"lessThan\": \"9.5.4\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"9.4.0\", \"lessThan\": \"9.4.4\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"9.3.0\", \"lessThan\": \"9.3.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"9.2.1\", \"lessThan\": \"9.2.16\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"9.1.0\", \"lessThan\": \"9.1.3\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"9.6.5\"}, {\"status\": \"unaffected\", \"version\": \"9.2.17\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:atlassian:bamboo_server:*:*:*:*:*:*:*:*\"], \"vendor\": \"atlassian\", \"product\": \"bamboo_server\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"9.4.4\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"9.3.0\", \"lessThan\": \"9.3.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"9.2.1\", \"lessThan\": \"9.2.16\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"9.1.0\", \"lessThan\": \"9.1.3\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"9.2.17\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-27T13:37:15.544Z\"}}], \"cna\": {\"credits\": [{\"lang\": \"en\", \"value\": \"Bug Bounty\"}], \"metrics\": [{\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 7.6, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"Atlassian\", \"product\": \"Bamboo Data Center\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.6.0 to 9.6.4\"}, {\"status\": \"affected\", \"version\": \"9.5.0 to 9.5.4\"}, {\"status\": \"affected\", \"version\": \"9.4.0 to 9.4.4\"}, {\"status\": \"affected\", \"version\": \"9.3.0 to 9.3.6\"}, {\"status\": \"affected\", \"version\": \"9.2.1 to 9.2.16\"}, {\"status\": \"affected\", \"version\": \"9.1.0 to 9.1.3\"}, {\"status\": \"unaffected\", \"version\": \"9.6.5\"}, {\"status\": \"unaffected\", \"version\": \"9.2.17\"}]}, {\"vendor\": \"Atlassian\", \"product\": \"Bamboo Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.4.0 to 9.4.4\"}, {\"status\": \"affected\", \"version\": \"9.3.0 to 9.3.6\"}, {\"status\": \"affected\", \"version\": \"9.2.1 to 9.2.16\"}, {\"status\": \"affected\", \"version\": \"9.1.0 to 9.1.3\"}, {\"status\": \"unaffected\", \"version\": \"9.2.17\"}]}], \"references\": [{\"url\": \"https://confluence.atlassian.com/pages/viewpage.action?pageId=1431535667\"}, {\"url\": \"https://jira.atlassian.com/browse/BAM-25858\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689\\u00a0 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server.\\r\\n\\r\\nThis RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.\\r\\n\\r\\nAtlassian recommends that Bamboo Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\\r\\n Bamboo Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.17\\r\\n\\r\\n Bamboo Data Center and Server 9.6: Upgrade to a release greater than or equal to 9.6.5\\r\\n\\r\\nSee the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).\\r\\n\\r\\nThis vulnerability was reported via our Bug Bounty program.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"RCE (Remote Code Execution)\", \"description\": \"RCE (Remote Code Execution)\"}]}], \"providerMetadata\": {\"orgId\": \"f08a6ab8-ed46-4c22-8884-d911ccfe3c66\", \"shortName\": \"atlassian\", \"dateUpdated\": \"2024-08-20T10:00:00.967Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-21689\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-13T15:46:54.670Z\", \"dateReserved\": \"2024-01-01T00:05:33.847Z\", \"assignerOrgId\": \"f08a6ab8-ed46-4c22-8884-d911ccfe3c66\", \"datePublished\": \"2024-08-20T10:00:00.967Z\", \"assignerShortName\": \"atlassian\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

WID-SEC-W-2024-1885

Vulnerability from csaf_certbund - Published: 2024-08-20 22:00 - Updated: 2024-08-20 22:00

Summary

Atlassian Bamboo: Mehrere Schwachstellen ermöglichen Codeausführung und DoS

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Bamboo ist ein Werkzeug zur kontinuierlichen Integration und Bereitstellung, das automatisierte Builds, Tests und Freigaben in einem einzigen Arbeitsablauf verbindet.

Angriff

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Atlassian Bamboo ausnutzen, um beliebigen Programmcode auszuführen und um einen Denial-of-Service-Zustand zu erzeugen.

Betroffene Betriebssysteme

- Sonstiges - UNIX - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Bamboo ist ein Werkzeug zur kontinuierlichen Integration und Bereitstellung, das automatisierte Builds, Tests und Freigaben in einem einzigen Arbeitsablauf verbindet.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Atlassian Bamboo ausnutzen, um beliebigen Programmcode auszuf\u00fchren und um einen Denial-of-Service-Zustand zu erzeugen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1885 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1885.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1885 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1885"
      },
      {
        "category": "external",
        "summary": "Atlassian Security Bulletin - August 20 2024 vom 2024-08-20",
        "url": "https://confluence.atlassian.com/security/security-bulletin-august-20-2024-1431535667.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Atlassian Bamboo: Mehrere Schwachstellen erm\u00f6glichen Codeausf\u00fchrung und DoS",
    "tracking": {
      "current_release_date": "2024-08-20T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-21T10:39:55.298+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.6"
        }
      },
      "id": "WID-SEC-W-2024-1885",
      "initial_release_date": "2024-08-20T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-08-20T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.6.5",
                "product": {
                  "name": "Atlassian Bamboo \u003c9.6.5",
                  "product_id": "T036975"
                }
              },
              {
                "category": "product_version",
                "name": "9.6.5",
                "product": {
                  "name": "Atlassian Bamboo 9.6.5",
                  "product_id": "T036975-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:9.6.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.2.17",
                "product": {
                  "name": "Atlassian Bamboo \u003c9.2.17",
                  "product_id": "T036976"
                }
              },
              {
                "category": "product_version",
                "name": "9.2.17",
                "product": {
                  "name": "Atlassian Bamboo 9.2.17",
                  "product_id": "T036976-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:9.2.17"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Bamboo"
          }
        ],
        "category": "vendor",
        "name": "Atlassian"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-21689",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine nicht n\u00e4her beschriebene Schwachstelle in Atlassian Bamboo. Ein entfernter, authentisierter Angreifer mit erh\u00f6hten Rechten kann dies ausnutzen, um beliebigen Code auszuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036975",
          "T036976"
        ]
      },
      "release_date": "2024-08-20T22:00:00.000+00:00",
      "title": "CVE-2024-21689"
    },
    {
      "cve": "CVE-2024-29857",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Atlassian Bamboo. Diese Fehler betrifft die org.bouncycastle:bcprov-jdk18on-Dependency und f\u00fchrt zu einem \u00fcberm\u00e4\u00dfigen CPU-Verbrauch auf dem System. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036975",
          "T036976"
        ]
      },
      "release_date": "2024-08-20T22:00:00.000+00:00",
      "title": "CVE-2024-29857"
    }
  ]
}

GSD-2024-21689

Vulnerability from gsd - Updated: 2024-01-01 06:02

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2024-21689

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-21689"
      ],
      "id": "GSD-2024-21689",
      "modified": "2024-01-01T06:02:05.298116Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2024-21689",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

FKIE_CVE-2024-21689

Vulnerability from fkie_nvd - Published: 2024-08-20 10:15 - Updated: 2025-03-13 16:15

Severity ?

8.0 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security@atlassian.com	https://confluence.atlassian.com/pages/viewpage.action?pageId=1431535667	Issue Tracking, Vendor Advisory
	security@atlassian.com	https://jira.atlassian.com/browse/BAM-25858	Issue Tracking, Vendor Advisory

Impacted products

	Vendor	Product	Version
	atlassian	bamboo	*
	atlassian	bamboo	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B5EC3F5F-AFF0-4FAD-AFC9-4BE967319F82",
              "versionEndExcluding": "9.2.17",
              "versionStartIncluding": "9.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "52F810C2-8E16-4B1A-B426-54CE82067349",
              "versionEndExcluding": "9.6.5",
              "versionStartIncluding": "9.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689\u00a0 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server.\r\n\r\nThis RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.\r\n\r\nAtlassian recommends that Bamboo Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Bamboo Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.17\r\n\r\n Bamboo Data Center and Server 9.6: Upgrade to a release greater than or equal to 9.6.5\r\n\r\nSee the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).\r\n\r\nThis vulnerability was reported via our Bug Bounty program."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) de alta gravedad, CVE-2024-21689, se introdujo en las versiones 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 y 9.6.0 de Bamboo Data Center and Server. Esta vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE), con una puntuaci\u00f3n CVSS de 7,6, permite a un atacante autenticado ejecutar c\u00f3digo arbitrario que tiene un alto impacto en la confidencialidad, la integridad y la disponibilidad, y requiere la interacci\u00f3n del usuario. Atlassian recomienda que los clientes de Bamboo Data Center and Server actualicen a la \u00faltima versi\u00f3n. Si no puede hacerlo, actualice su instancia a una de las versiones corregidas compatibles especificadas: Bamboo Data Center and Server 9.2: actualice a una versi\u00f3n mayor o igual a 9.2.17 Bamboo Data Center and Server 9.6: actualice a una versi\u00f3n mayor o igual a 9.6.5 Consulte las notas de la versi\u00f3n ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). Puede descargar la \u00faltima versi\u00f3n de Bamboo Data Center and Server desde el centro de descargas ([https://www.atlassian.com/software/bamboo/download-archives]). Esta vulnerabilidad se inform\u00f3 a trav\u00e9s de nuestro programa Bug Bounty."
    }
  ],
  "id": "CVE-2024-21689",
  "lastModified": "2025-03-13T16:15:17.273",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 6.0,
        "source": "security@atlassian.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-08-20T10:15:04.103",
  "references": [
    {
      "source": "security@atlassian.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1431535667"
    },
    {
      "source": "security@atlassian.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/BAM-25858"
    }
  ],
  "sourceIdentifier": "security@atlassian.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-H63C-4F8G-75QG

Vulnerability from github – Published: 2024-08-20 12:30 – Updated: 2025-03-13 18:32

Details

This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server.

This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.

Atlassian recommends that Bamboo Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Bamboo Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.17

Bamboo Data Center and Server 9.6: Upgrade to a release greater than or equal to 9.6.5

See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).

This vulnerability was reported via our Bug Bounty program.

Severity ?

7.6 (High)


                  
                    CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-21689"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-20T10:15:04Z",
    "severity": "HIGH"
  },
  "details": "This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689\u00a0 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server.\n\nThis RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.\n\nAtlassian recommends that Bamboo Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n Bamboo Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.17\n\n Bamboo Data Center and Server 9.6: Upgrade to a release greater than or equal to 9.6.5\n\nSee the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).\n\nThis vulnerability was reported via our Bug Bounty program.",
  "id": "GHSA-h63c-4f8g-75qg",
  "modified": "2025-03-13T18:32:09Z",
  "published": "2024-08-20T12:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21689"
    },
    {
      "type": "WEB",
      "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1431535667"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/BAM-25858"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-21689 (GCVE-0-2024-21689)

WID-SEC-W-2024-1885

GSD-2024-21689

FKIE_CVE-2024-21689

GHSA-H63C-4F8G-75QG

Tags

Sightings

Nomenclature