CVE-2016-5229
CriticalSummary
Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, allowing remote attackers to execute arbitrary code via vectors related to XStream Serialization.
Risk Assessment
This vulnerability may lead to remote code execution, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update Atlassian Bamboo to the latest version to mitigate this vulnerability and implement additional security measures regarding deserialization.
Other vulnerabilities in Atlassian Bamboo
See all- CVE-2017-8907High
Atlassian Bamboo versions 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission. An attacker who can log in as a user without these permissions can create a deployment project and execute arbitrary code on an available Bamboo Agent.
- CVE-2015-8361Critical
Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, allowing remote attackers to obtain sensitive information, modify settings, or manage build agents.
- CVE-2015-8360Critical
An unspecified vulnerability in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.
Original NVD description (English source)
Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via vectors related to XStream Serialization.