CVE-2017-18042: The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to...

Security readout for executives and security teams

CVE-2017-18042 is a CSRF flaw in Atlassian Bamboo before 6.3.1. A remote attacker could cause user administration changes, including password changes. For executives, the concern is unauthorized account modification in a CI/CD system, not confirmed mass exploitation. Exposure is limited to Atlassian Bamboo deployments running versions before 6.3.1. Risk is higher where Bamboo is reachable by many users or administrators routinely access it through browsers. Prioritize remediation for any Bamboo instance below 6.3.1, especially production CI/CD systems. The issue affects identity administration and could disrupt build operations or enable unauthorized access, but public evidence here does not show active exploitation. Mitigation focus: Upgrade Bamboo to version 6.3.1 or later.; Review Atlassian issue BAM-19663 for vendor-specific guidance.; Restrict Bamboo administrative access to trusted networks and users..

Prepared

Jun 7, 2026, 20:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.