QID 731322

Atlassian Bamboo is a continuous integration (CI) and deployment server. Bamboo Data Center is a continuous delivery pipeline that offers resilience, reliability, and scalability for teams of any size.

CVE-2023-28709: This Third-Party Dependency vulnerability, allows an attacker to expose assets in your environment susceptible to exploitation.

Affected Bamboo Server and Data Center:
from 8.1.12 to 9.2.3.
from 9.2.0 to 9.2.3.
from 9.3.0 to prior to 9.3.1

QID Detection Logic:(Unauthenticated):
QID checks for the vulnerable versions of Atlassian Bamboo via GET login request.

QID Detection Logic:(Windows):
QID checks for the vulnerable versions of Atlassian Bamboo through the registry key.

Successful exploitation of this vulnerability allows unauthenticated attacker to expose assets in your environment.