Hello @Vansh, Welcome to Atlassian Community!
CVS-2020-9488
Atlassian classified it as a “low” based on its CVSSv3 base score (read more about security levels for security issues). Vulnerabilities in the low range typically have very little impact on an organization's business. The exploitation of such vulnerabilities usually requires local or physical system access. Vulnerabilities in third-party code that are unreachable from Atlassian code may be downgraded to low severity.
CVE-2022-23302, CVE-2022-23305, and CVE-2022-23307
Short answer: Fix available
Bamboo 8.0.6, 8.1.5 and 8.2.1 contain a fix for those three CVEs. Please plan to upgrade at your earliest convenience.
As the CVE-2022-22965 vulnerability (Spring4shell) was fixed on Bamboo releases 8.0.7, 8.1.6 and 8.2.2 please consider those or later releases instead. Please keep an eye on our FAQ for CVE-2022-22965 for more information.
Regards,
Eduardo Alvarenga
Atlassian Support APAC
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.