CVE-2016-5229 Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via vectors related to XS...
CriticalCVSS 9.8
EPSS 7.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via vectors related to XStream Serialization.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian bamboo | <= 5.11.3 | No fix listed |
| atlassian bamboo | = 5.12.0 | No fix listed |
| atlassian bamboo | = 5.12.1 | No fix listed |
| atlassian bamboo | = 5.12.2 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- 20160726 July 2016 - Bamboo Server - Critical Security Advisory mailing-list
- 92057 third-party-advisory vdb-entry
- confluence.atlassian.com vendor-advisory
- jira.atlassian.com issue-tracking