CVE-2014-9757

Critical

Published: 08/02/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The Smack XMPP API in Ignite Realtime, used in Atlassian Bamboo before version 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitrary Java code via serialized data in an XMPP message.

Risk Assessment

An attacker could exploit this vulnerability to remotely execute unauthorized code, potentially leading to serious security breaches in the system.

Recommendation

It is recommended to update Atlassian Bamboo to the latest version to mitigate this vulnerability and restrict access to XMPP servers.

Original NVD description (English source)

The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitrary Java code via serialized data in an XMPP message.