CVE-2016-5229

EPSS 6.03%
Veröffentlicht 02.08.2016 16:59:02
Zuletzt bearbeitet 12.04.2025 10:46:40
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via vectors related to XStream Serialization.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 8

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Atlassian ≫ Bamboo Version <= 5.11.3

Atlassian ≫ Bamboo Version5.12.0

Atlassian ≫ Bamboo Version5.12.1

Atlassian ≫ Bamboo Version5.12.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	6.03%	0.903

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

http://packetstormsecurity.com/files/138053/Bamboo-Deserialization-Issue.html

Third Party Advisory

VDB Entry

http://www.securityfocus.com/archive/1/539003/100/0/threaded

http://www.securityfocus.com/bid/92057

Third Party Advisory

VDB Entry

https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2016-07-20-831660461.html

Vendor Advisory

https://jira.atlassian.com/browse/BAM-17736

Issue Tracking

https://nvd.nist.gov/vuln/detail/CVE-2016-5229

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-5229

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-5229

EUVD