QID 731325

Atlassian Bamboo is a continuous integration (CI) and deployment server. Bamboo Data Center is a continuous delivery pipeline that offers resilience, reliability, and scalability for teams of any size.

CVE-2021-46877,CVE-2022-42003: This Third-Party Dependency vulnerability, allows an unauthenticated attacker to expose assets in the environment susceptible to exploitation.

Affected Bamboo Server and Data Center:
from version 9.1.0 to 9.1.3
from version 9.2.1 to 9.2.4
from version 9.3.0 to 9.3.2.

QID Detection Logic:(Unauthenticated):
QID checks for the vulnerable versions of Atlassian Bamboo via GET login request.

QID Detection Logic:(Windows):
QID checks for the vulnerable versions of Atlassian Bamboo through the registry key.

Successful exploitation of this vulnerability allows unauthenticated attacker to expose assets in your environment.