CVE-2017-14589

CVE-2017-14589 describes a critical vulnerability in Atlassian Bamboo, affecting versions prior to 6.1.6 and 6.2.0 through 6.2.4. This flaw allows for double OGNL evaluation within FreeMarker templates via Struts FreeMarker tags, enabling an attacker with restricted administration rights or through a malicious website to execute arbitrary Java code on the Bamboo server. The vulnerability carries a CVSS score of 9.6 (CRITICAL), indicating a severe impact with high confidentiality, integrity, and availability risks. It can be exploited over the network with low attack complexity, though user interaction is required. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has also received minimal community discussion and media coverage.