GHSA-6GHH-4PM9-H5H5高危未审查

无摘要

OSV 1.4.0 · unreviewed · 修改于 2026-09-02 08:31

发布时间

2026-08-19 08:31

GitHub 审查时间

—

NVD 发布时间

2026-08-19 06:16

源文件

advisories/unreviewed/2026/08/GHSA-6ghh-4pm9-h5h5/GHSA-6ghh-4pm9-h5h5.json

公告说明

This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center.

This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. 

Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
	
	* Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.22
	
	* Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.10
	
	

See the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives). 

This vulnerability was reported via our Penetration Testing program.

受影响的软件包

该公告没有提供结构化的受影响软件包信息。

参考链接

标识信息

别名 / CVE

CVE-2026-21584

CWE

CWE-285

软件生态

无

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

原始 OSV JSON

{
  "id": "GHSA-6ghh-4pm9-h5h5",
  "aliases": [
    "CVE-2026-21584"
  ],
  "details": "This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. \n\t\n\tThis Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. \n\t\n\tAtlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n\t\t\n\t\t* Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.22\n\t\t\n\t\t* Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.10\n\t\t\n\t\t\n\t\n\tSee the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives). \n\t\n\tThis vulnerability was reported via our Penetration Testing program.",
  "affected": [],
  "modified": "2026-09-02T00:31:27Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
    },
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  ],
  "published": "2026-08-19T00:31:10Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21584",
      "type": "ADVISORY"
    },
    {
      "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999768",
      "type": "WEB"
    },
    {
      "url": "https://jira.atlassian.com/browse/BAM-26468",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "nvd_published_at": "2026-08-18T22:16:50Z",
    "github_reviewed_at": null
  }
}