CVE-2017-14589

CRITICAL Year: 2017
CVSS v3 Score
9.6
Critical
CVSS v2 Score
6.8
Medium
Weakness Type
CWE-20
View all →

Vulnerability Description

It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted administration rights to Bamboo or who hosts a website that a Bamboo administrator visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Bamboo. All versions of Bamboo before 6.1.6 (the fixed version for 6.1.x) and from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) are affected by this vulnerability.

Related Vulnerabilities

CVE-2016-1706

CRITICAL
CVSS:9.6(Critical)

The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origin of IPC messages to the plugin broker process that should have come from the browser process, which allows rem...

CWE-202016

CVE-2017-15402

CRITICAL
CVSS:9.6(Critical)

Using an ID that can be controlled by a compromised renderer which allows any frame to overwrite the page_state of any other frame in the same process in Navigation in Google Chrome on Chrome OS prior...

CWE-202017

CVE-2018-0104

CRITICAL
CVSS:9.6(Critical)

A vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a remote attacker to execute arbitrary code on the system of a targeted user. The attacker...

CWE-202018

CVE-2018-0264

CRITICAL
CVSS:9.6(Critical)

A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remote attacker to execute arbitrary code on the system of a targe...

CWE-202018

CVE-2018-11314

CRITICAL
CVSS:9.6(Critical)

The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. This can result in remote device control and privileged device and network information to be ex...

CWE-202018

CVE-2018-11316

CRITICAL
CVSS:9.6(Critical)

The UPnP HTTP server on Sonos wireless speaker products allow unauthorized access via a DNS rebinding attack. This can result in remote device control and privileged device and network information to ...

CWE-202018