CVE-2016-5229

CWE-284 — Improper Access Control3 documents3 sources
Severity
9.8CRITICAL
EPSS
6.0%
top 9.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Atlassian Bamboo
Timeline
PublishedAug 2
Latest updateMay 14

Description

Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via vectors related to XStream Serialization.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDatlassian/bamboo5.11.3+3

🔴Vulnerability Details

2
GHSA
GHSA-j677-8364-49vm: Atlassian Bamboo before 5↗2022-05-14
▶
CVEList
CVE-2016-5229: Atlassian Bamboo before 5↗2016-08-02
▶
CVE-2016-5229 (CRITICAL CVSS 9.8) | Atlassian Bamboo before 5.11.4.1 an | cvebase.io