CVE-2016-5229

Critical

Published: 02/08/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, allowing remote attackers to execute arbitrary code via vectors related to XStream Serialization.

Risk Assessment

This vulnerability may lead to remote code execution, posing a serious threat to the security of the system and the organization's data.

Recommendation

It is recommended to update Atlassian Bamboo to the latest version to mitigate this vulnerability and implement additional security measures regarding deserialization.

Original NVD description (English source)

Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via vectors related to XStream Serialization.