QID 731340

Atlassian Bamboo is a continuous integration (CI) and deployment server. Bamboo Data Center is a continuous delivery pipeline that offers resilience, reliability, and scalability for teams of any size.

CVE-2023-5072: org.json:json Dependency vulnerability allows an unauthenticated attacker to expose assets in the environment susceptible to exploitation.

Affected Bamboo Server and Data Center:
from 8.1.0 to 8.1.12
from 8.2.0 to 8.2.9
from 9.0.0 to 9.0.4
from 9.1.0 to 9.1.3
from 9.2.3 to prior to 9.2.7
from 9.3.0 to prior to 9.3.5
from 9.4.0 to prior to 9.4.2

QID Detection Logic:(Unauthenticated):
QID checks for the vulnerable versions of Atlassian Bamboo via GET login request.

QID Detection Logic:(Windows):
QID checks for the vulnerable versions of Atlassian Bamboo through the registry key.

Successful exploitation of this vulnerability allows unauthenticated attacker to expose assets in the environment.