This vulnerability is an OS Command Injection flaw that allows an authenticated attacker to execute arbitrary commands on a Bamboo Data Center server. The flaw provides complete compromise of confidentiality, integrity, and availability, and requires no user interaction. According to the CVSS vector, the attack can be performed over a network with low attack complexity and low required privileges.

The issue affects Atlassian Bamboo Data Center running any of the following versions released before the indicated fixes: 9.6.0 through 9.6.24, the earlier 10.x releases up to 10.2.17, and the earlier 12.x releases up to 12.1.5. Atlassian recommends upgrading to Bamboo Data Center 9.6.25 or later, 10.2.18 or later, or 12.1.6 or later to eliminate the vulnerability.

With a CVSS score of 9.4 and an EPSS score that is not available, the risk remains high. The flaw is listed as not part of the CISA KEV catalogue. Because the vulnerability can be exploited by anyone who can authenticate to the Bamboo service, a compromised or malicious user can gain full control over the underlying host. The lack of user interaction and the low attack complexity mean that a determined attacker can quickly achieve full system compromise.