CVE-2024-21689
Published: 20 August 2024
Summary
CVE-2024-21689 is a high-severity Code Injection (CWE-94) vulnerability in Atlassian Bamboo. Its CVSS base score is 8.0 (High).
Operationally, ranked in the top 2.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-21689 is a high-severity remote code execution vulnerability affecting Atlassian Bamboo Data Center and Server versions 9.1.0 through 9.6.0. It carries a CVSS 3.1 score of 8.0 and stems from improper control of code generation, enabling an authenticated attacker to execute arbitrary code on the affected instance.
An authenticated attacker with user interaction can exploit the flaw over the network to achieve high impacts on confidentiality, integrity, and availability by running arbitrary code within the Bamboo environment. The vulnerability was identified through Atlassian's bug bounty program.
Atlassian advises customers to upgrade Bamboo Data Center and Server to the latest release or to a fixed version such as 9.2.17 or later for the 9.2 branch and 9.6.5 or later for the 9.6 branch, with release notes and downloads available from the vendor's sites. The current EPSS score of 0.37 with a recorded peak of 0.42 does not indicate a pronounced post-disclosure climb from a low baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19305
Vulnerability details
This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.6, allows an…
more
authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Bamboo Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Bamboo Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.17 Bamboo Data Center and Server 9.6: Upgrade to a release greater than or equal to 9.6.5 See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives]). This vulnerability was reported via our Bug Bounty program.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.