Atlassian Bamboo vulnerabilities
4 known CVE vulnerabilities in Atlassian Bamboo, translated and rated.
- CVE-2017-8907High
Atlassian Bamboo versions 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission. An attacker who can log in as a user without these permissions can create a deployment project and execute arbitrary code on an available Bamboo Agent.
- CVE-2016-5229Critical
Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, allowing remote attackers to execute arbitrary code via vectors related to XStream Serialization.
- CVE-2015-8361Critical
Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, allowing remote attackers to obtain sensitive information, modify settings, or manage build agents.
- CVE-2015-8360Critical
An unspecified vulnerability in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.