CVE-2021-26067: 
Bamboo vulnerability analysis and mitigation

Atlassian Bamboo versions before 7.2.2 contain a Sensitive Data Exposure vulnerability (CVE-2021-26067) that allows an unauthenticated remote attacker to view a stack trace through the /chart endpoint. The vulnerability was discovered and disclosed in January 2021 (Vendor Advisory).

The vulnerability exists in the /chart endpoint of Atlassian Bamboo. When accessed with specific parameters, the endpoint exposes stack traces that may reveal sensitive system information including the path for the home directory on disk and the existence of certain files in the tmp directory. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows unauthorized access to sensitive system information through stack trace exposure. Attackers can potentially discover the home directory path and determine the existence of files in temporary directories, which could be leveraged for further attacks (NVD).

The vulnerability can be exploited remotely by an unauthenticated attacker by accessing the /chart endpoint with specific parameters. No special privileges or user interaction is required for exploitation (NVD).

The vulnerability has been fixed in Atlassian Bamboo version 7.2.2. Users running affected versions should upgrade to version 7.2.2 or later to mitigate this security issue (Vendor Advisory).