Vulnerability in Atlassian Bamboo
CVE-2016-5229
Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via vectors related to XStream Serialization.
EPSS: 0.060 (90.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Atlassian Bamboo — versions 5.12.0, 5.12.1, 5.12.2
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- 20160726 July 2016 - Bamboo Server - Critical Security Advisory (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (VDB Entry, Third Party Advisory, x_refsource_MISC)
- 92057 (Third Party Advisory, VDB Entry, vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM, Issue Tracking)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2016-5229?
- CVE-2016-5229 is a critical-severity vulnerability in Atlassian Bamboo, classified under Improper Access Control. CVSS score: 9.8/10. Published 2016-08-02.
- How severe is CVE-2016-5229?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2016-5229 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.