Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root


1 badge earned


Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!


Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.


Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!


Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
Community Members
Community Events
Community Groups

Bamboo and CVE-2018-11776 (Apache Struts) vulnerability

Dear Atlassian Team

On this page there's a brief message that no Atlassian product is impacted by CVE-2018-11776. However, to keep our Risk & Governance stakeholders suitably informed, would it please be possible for Atlassian to release an advisory confirming there's no impact and positively confirming that this is true for Bamboo as well?

It would be very useful to have official comms on this (vs a comment on a forum).

Given this is an RCE (remote code exection) vuln organizations with automated scanners are flagging Bamboo as vulnerable. An advisory will help ensure that teams using Bamboo can continue to do so confidently.

Thank you!

1 answer

1 accepted

2 votes
Answer accepted
Adrian Ludwig
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
Aug 29, 2018

Hi Prasenjeet,

There are new security issues found every day, so we don't generally release advisories to say that an issue doesn't affect one of our products. 

Our security team has investigated CVE-2018-11776 and we can confirm that no Atlassian products are affected by this vulnerability -- this includes Bamboo. While we do use Struts for some products, they are not configured in a way that would leave them open to this bug. But as an extra precaution, we are updating all of the products that use Struts to the latest version.

Which security scanner are you running that is incorrectly flagging Bamboo?


Atlassian Security

Jeyanthan I
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
Aug 30, 2018 • edited

Added to my colleague's inputs, I just wanted to update that as an extra precaution that is in-line with industry best practices, the next release - Bamboo 6.7 will contain the latest updated Struts jar in it (even though Bamboo is not affected by this vulnerability).

This is expected to be released in the coming weeks on September 2018. So I suggest you wait and upgrade your Bamboo if you want. This is tracked here - Upgrade Struts to 2.5.17.

Hope that helps.


Suggest an answer

Log in or Sign up to answer
AUG Leaders

Atlassian Community Events