Read the docs
TI-2017-06402 Aliases CVE-2017-8907GHSA-4c52-gf37-2pfp

Incorrect authorization in Atlassian Bamboo

Priority MEDIUM 43CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-863.

Summary

Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01669 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianAtlassian Bamboo5.0.0 <= version < 5.15.7; 6.0.0 <= version < 6.0.1—No fix listedCNA
  • Atlassian Bamboo VendorAtlassian Affected 5.0.0 <= version < 5.15.7; 6.0.0 <= version < 6.0.1 Fixed in — No fix listed CNA

CPE configurations NVD · 53

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:bamboo:5.0:*:*:*:*:*:*:*5.0VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.0:beta1:*:*:*:*:*:*5.0 beta1VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.0:beta2:*:*:*:*:*:*5.0 beta2VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.0:beta3:*:*:*:*:*:*5.0 beta3VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.0:rc1:*:*:*:*:*:*5.0 rc1VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.0.1:*:*:*:*:*:*:*5.0.1VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.1:*:*:*:*:*:*:*5.1VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.1.1:*:*:*:*:*:*:*5.1.1VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.2:*:*:*:*:*:*:*5.2VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.2.1:*:*:*:*:*:*:*5.2.1VulnerableAtlassian
  • cpe:2.3:a:atlassian:bamboo:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.0:beta1:*:*:*:*:*:* Versions 5.0 beta1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.0:beta2:*:*:*:*:*:* Versions 5.0 beta2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.0:beta3:*:*:*:*:*:* Versions 5.0 beta3 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.0:rc1:*:*:*:*:*:* Versions 5.0 rc1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.1.1:*:*:*:*:*:*:* Versions 5.1.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.2:*:*:*:*:*:*:* Versions 5.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.2.1:*:*:*:*:*:*:* Versions 5.2.1 Vulnerable ·Atlassian
Show 43 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:atlassian:bamboo:5.2.2:*:*:*:*:*:*:*5.2.2VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.3:*:*:*:*:*:*:*5.3VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.4:*:*:*:*:*:*:*5.4VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.4.1:*:*:*:*:*:*:*5.4.1VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.4.2:*:*:*:*:*:*:*5.4.2VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.5:*:*:*:*:*:*:*5.5VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.6:*:*:*:*:*:*:*5.6VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.6.1:*:*:*:*:*:*:*5.6.1VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.6.2:*:*:*:*:*:*:*5.6.2VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.7:*:*:*:*:*:*:*5.7VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.7.1:*:*:*:*:*:*:*5.7.1VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.7.2:*:*:*:*:*:*:*5.7.2VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.8:*:*:*:*:*:*:*5.8VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.8.1:*:*:*:*:*:*:*5.8.1VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.8.2:*:*:*:*:*:*:*5.8.2VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.8.5:*:*:*:*:*:*:*5.8.5VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.9:*:*:*:*:*:*:*5.9VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.9.1:*:*:*:*:*:*:*5.9.1VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.9.2:*:*:*:*:*:*:*5.9.2VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.9.3:*:*:*:*:*:*:*5.9.3VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.9.4:*:*:*:*:*:*:*5.9.4VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.9.7:*:*:*:*:*:*:*5.9.7VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.11.3:*:*:*:*:*:*:*5.11.3VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.12.0:*:*:*:*:*:*:*5.12.0VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.12.1:*:*:*:*:*:*:*5.12.1VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.12.2:*:*:*:*:*:*:*5.12.2VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.12.4:*:*:*:*:*:*:*5.12.4VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.12.5:*:*:*:*:*:*:*5.12.5VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.13.0:*:*:*:*:*:*:*5.13.0VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.13.1:*:*:*:*:*:*:*5.13.1VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.13.2:*:*:*:*:*:*:*5.13.2VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.14.0:*:*:*:*:*:*:*5.14.0VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.14.1:*:*:*:*:*:*:*5.14.1VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.14.2:*:*:*:*:*:*:*5.14.2VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.14.3:*:*:*:*:*:*:*5.14.3VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.14.4.1:*:*:*:*:*:*:*5.14.4.1VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.14.5:*:*:*:*:*:*:*5.14.5VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.15.0:*:*:*:*:*:*:*5.15.0VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.15.2:*:*:*:*:*:*:*5.15.2VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.15.3:*:*:*:*:*:*:*5.15.3VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.15.4:*:*:*:*:*:*:*5.15.4VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:5.15.5:*:*:*:*:*:*:*5.15.5VulnerableAtlassian
cpe:2.3:a:atlassian:bamboo:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableAtlassian
  • cpe:2.3:a:atlassian:bamboo:5.2.2:*:*:*:*:*:*:* Versions 5.2.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.3:*:*:*:*:*:*:* Versions 5.3 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.4:*:*:*:*:*:*:* Versions 5.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.4.1:*:*:*:*:*:*:* Versions 5.4.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.4.2:*:*:*:*:*:*:* Versions 5.4.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.5:*:*:*:*:*:*:* Versions 5.5 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.6:*:*:*:*:*:*:* Versions 5.6 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.6.1:*:*:*:*:*:*:* Versions 5.6.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.6.2:*:*:*:*:*:*:* Versions 5.6.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.7:*:*:*:*:*:*:* Versions 5.7 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.7.1:*:*:*:*:*:*:* Versions 5.7.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.7.2:*:*:*:*:*:*:* Versions 5.7.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.8:*:*:*:*:*:*:* Versions 5.8 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.8.1:*:*:*:*:*:*:* Versions 5.8.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.8.2:*:*:*:*:*:*:* Versions 5.8.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.8.5:*:*:*:*:*:*:* Versions 5.8.5 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.9:*:*:*:*:*:*:* Versions 5.9 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.9.1:*:*:*:*:*:*:* Versions 5.9.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.9.2:*:*:*:*:*:*:* Versions 5.9.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.9.3:*:*:*:*:*:*:* Versions 5.9.3 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.9.4:*:*:*:*:*:*:* Versions 5.9.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.9.7:*:*:*:*:*:*:* Versions 5.9.7 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.11.3:*:*:*:*:*:*:* Versions 5.11.3 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.12.0:*:*:*:*:*:*:* Versions 5.12.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.12.1:*:*:*:*:*:*:* Versions 5.12.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.12.2:*:*:*:*:*:*:* Versions 5.12.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.12.4:*:*:*:*:*:*:* Versions 5.12.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.12.5:*:*:*:*:*:*:* Versions 5.12.5 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.13.0:*:*:*:*:*:*:* Versions 5.13.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.13.1:*:*:*:*:*:*:* Versions 5.13.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.13.2:*:*:*:*:*:*:* Versions 5.13.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.14.0:*:*:*:*:*:*:* Versions 5.14.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.14.1:*:*:*:*:*:*:* Versions 5.14.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.14.2:*:*:*:*:*:*:* Versions 5.14.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.14.3:*:*:*:*:*:*:* Versions 5.14.3 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.14.4.1:*:*:*:*:*:*:* Versions 5.14.4.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.14.5:*:*:*:*:*:*:* Versions 5.14.5 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.15.0:*:*:*:*:*:*:* Versions 5.15.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.15.2:*:*:*:*:*:*:* Versions 5.15.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.15.3:*:*:*:*:*:*:* Versions 5.15.3 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.15.4:*:*:*:*:*:*:* Versions 5.15.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:5.15.5:*:*:*:*:*:*:* Versions 5.15.5 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bamboo:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Atlassian

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-8907
  2. 2026-10-03 Alias added: GHSA-4c52-gf37-2pfp

References

Advisory 1

  • TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
  • TI-2012-02540 Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before… CVSS 3.1CRITICAL 9.1
  • TI-2022-09598 Improper authentication in Atlassian Bamboo Server CVSS 3.1CRITICAL 9.8
  • TI-2016-04529 Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict… CVSS 3.0CRITICAL 9.8
  • TI-2015-06881 An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows… CVSS 3.0CRITICAL 9.8
  • TI-2014-07936 The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x… CVSS 3.0CRITICAL 9.8
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences