CVE-2024-21687: 
Bamboo Análise e mitigação de vulnerabilidades

A high-severity File Inclusion vulnerability (CVE-2024-21687) was discovered in Bamboo Data Center and Server, affecting versions 9.0.0 through 9.6.3. The vulnerability was reported through Atlassian's Bug Bounty program and was disclosed on July 16, 2024. This security flaw impacts multiple versions of Bamboo Data Center and Server, including various LTS releases (Atlassian Security, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. The flaw allows an authenticated attacker to access and display the contents of local files or execute different files already stored locally on the server. The vulnerability requires low attack complexity and no user interaction, while having high impact on both confidentiality and integrity, but no impact on availability (NVD, Atlassian JIRA).

The vulnerability poses significant risks to affected systems, allowing authenticated attackers to view the contents of local files and potentially execute files stored on the server. This results in high impact to both confidentiality and integrity of the system, potentially exposing sensitive information and compromising system security (Security Online).

Atlassian recommends that all affected users upgrade to the latest fixed versions. For version 9.6.x (LTS), upgrade to version 9.6.4; for version 9.2.x (LTS), upgrade to version 9.2.16. Users on other affected versions (9.0.0-9.5.4) should upgrade to either 9.6.4 LTS (recommended) or 9.2.16 LTS. The fixes are available through Atlassian's download center (Atlassian Security).