Atlassian Bamboo CVE-2017-18042 Cross Site Request Forgery Vulnerability

Bugtraq ID:	103110
Class:	Design Error
CVE:	CVE-2017-18042
Remote:	Yes
Local:	No
Published:	Feb 13 2018 12:00AM
Updated:	Feb 13 2018 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Atlassian Bamboo 6.2.1 Atlassian Bamboo 6.2 Atlassian Bamboo 6.1.4 Atlassian Bamboo 6.1.3 Atlassian Bamboo 6.1.2 Atlassian Bamboo 6.1.1 Atlassian Bamboo 6.1 Atlassian Bamboo 6.0.5 Atlassian Bamboo 6.0.4 Atlassian Bamboo 6.0.3 Atlassian Bamboo 6.0.2 Atlassian Bamboo 6.0.1 Atlassian Bamboo 6.0 Atlassian Bamboo 5.15.7 Atlassian Bamboo 5.15.3 Atlassian Bamboo 5.15 Atlassian Bamboo 5.14.5 Atlassian Bamboo 5.12 Atlassian Bamboo 5.11 Atlassian Bamboo 5.10 Atlassian Bamboo 5.9.9 Atlassian Bamboo 5.9.7 Atlassian Bamboo 5.9.6 Atlassian Bamboo 5.9.5 Atlassian Bamboo 5.9.4 Atlassian Bamboo 5.9.3 Atlassian Bamboo 5.9.2 Atlassian Bamboo 5.9.1 Atlassian Bamboo 5.9 Atlassian Bamboo 5.8.5 Atlassian Bamboo 5.5.1 Atlassian Bamboo 5.4.3 Atlassian Bamboo 5.2.2 Atlassian Bamboo 5.1 Atlassian Bamboo 4.0.2 Atlassian Bamboo 4.0.1 Atlassian Bamboo 3.1.4 Atlassian Bamboo 1.2.2 Atlassian Bamboo 6.2.5 Atlassian Bamboo 6.1.6 Atlassian Bamboo 5.6 Atlassian Bamboo 5.5 Atlassian Bamboo 5.2 Atlassian Bamboo 5.12.3.1 Atlassian Bamboo 5.11.4.1 Atlassian Bamboo 4.0.0 Atlassian Bamboo 3.4.4 Atlassian Bamboo 3.4.3 Atlassian Bamboo 3.4.2 Atlassian Bamboo 3.4.1 Atlassian Bamboo 3.4 Atlassian Bamboo 3.3.3 Atlassian Bamboo 3.3.2 Atlassian Bamboo 3.3.1 Atlassian Bamboo 3.2.2 Atlassian Bamboo 3.2 Atlassian Bamboo 3.1.3 Atlassian Bamboo 3.1.1 Atlassian Bamboo 3.0.3 Atlassian Bamboo 3.0.2 Atlassian Bamboo 3.0.1 Atlassian Bamboo 3.0 Atlassian Bamboo 2.7.4 Atlassian Bamboo 2.7.3 Atlassian Bamboo 2.7.2 Atlassian Bamboo 2.7.1 Atlassian Bamboo 2.7 Atlassian Bamboo 2.6.3 Atlassian Bamboo 2.6.2 Atlassian Bamboo 2.6.1 Atlassian Bamboo 2.6 Atlassian Bamboo 2.5.5 Atlassian Bamboo 2.5.3 Atlassian Bamboo 2.5.2 Atlassian Bamboo 2.5.1 Atlassian Bamboo 2.4.3 Atlassian Bamboo 2.4.2 Atlassian Bamboo 2.0.6 Atlassian Bamboo 2.0.4 Atlassian Bamboo 2.0.3 Atlassian Bamboo 2.0.2 Atlassian Bamboo 2.0.1 Atlassian Bamboo 2.0 Atlassian Bamboo 1.2.4 Atlassian Bamboo 1.2.3 Atlassian Bamboo 1.2.1 Atlassian Bamboo 1.1.2 Atlassian Bamboo 1.1.1 Atlassian Bamboo 1.0.5 Atlassian Bamboo 1.0.4 Atlassian Bamboo 1.0.3 Atlassian Bamboo 1.0.2 Atlassian Bamboo 1.0.1
Not Vulnerable:	Atlassian Bamboo 6.3.1

Atlassian Bamboo CVE-2017-18042 Cross Site Request Forgery Vulnerability

Atlassian Bamboo is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.

Exploiting this issue allows a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

Versions prior to Atlassian Bamboo 6.3.1 are vulnerable.

Atlassian Bamboo CVE-2017-18042 Cross Site Request Forgery Vulnerability

An attacker can exploit this issue using a web browser.

Atlassian Bamboo CVE-2017-18042 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Atlassian Bamboo CVE-2017-18042 Cross Site Request Forgery Vulnerability

References:

• Atlassian JIRA Homepage (Atlassian)
  
• Cross-site request forgery (CSRF) in the update user administration resource - C (Atlassian)