Bamboo and CVE-2018-11776 (Apache Struts) vulnerability

Prasenjeet Dutta

Dear Atlassian Team

On this page there's a brief message that no Atlassian product is impacted by CVE-2018-11776. However, to keep our Risk & Governance stakeholders suitably informed, would it please be possible for Atlassian to release an advisory confirming there's no impact and positively confirming that this is true for Bamboo as well?

It would be very useful to have official comms on this (vs a comment on a forum).

Given this is an RCE (remote code exection) vuln organizations with automated scanners are flagging Bamboo as vulnerable. An advisory will help ensure that teams using Bamboo can continue to do so confidently.

Thank you!

Adrian Ludwig

Hi Prasenjeet,

There are new security issues found every day, so we don't generally release advisories to say that an issue doesn't affect one of our products. 

Our security team has investigated CVE-2018-11776 and we can confirm that no Atlassian products are affected by this vulnerability -- this includes Bamboo. While we do use Struts for some products, they are not configured in a way that would leave them open to this bug. But as an extra precaution, we are updating all of the products that use Struts to the latest version.

Which security scanner are you running that is incorrectly flagging Bamboo?

Adrian 

Atlassian Security