Atlassian Bamboo vulnerabilities, page 2
28 vulnerabilities
Known vulnerabilities in Atlassian Bamboo, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2017-9514atlassian · bambooatlassian bambooBamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. An attacker who can log in to Bamboo as a user is able to exploit this vulnerability to execute Java code of their choice on systems that have vulnerable versions of Bamboo.CVSS8.8HighEPSS1.05%RoutineCVE-2015-6576atlassian · bambooatlassian bambooBamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecified resource.CVSS8.8HighEPSS3.67%RoutineCVE-2017-8907atlassian · atlassian bamboo +1 moreatlassian atlassian bambooAtlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.CVSS8.8HighEPSS1.67%PrioritiseCVE-2016-5229atlassian · bambooatlassian bambooAtlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via vectors related to XStream Serialization.CVSS9.8CriticalEPSS7.09%PrioritiseCVE-2015-8361atlassian · bambooatlassian bambooMultiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote attackers to obtain sensitive information, modify settings, or manage build agents via unknown vectors involving the JMS port.CVSS9.1CriticalEPSS2.84%PrioritiseCVE-2015-8360atlassian · bambooatlassian bambooAn unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.CVSS9.8CriticalEPSS2.98%PrioritiseCVE-2014-9757atlassian · bambooatlassian bambooThe Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitrary Java code via serialized data in an XMPP message.CVSS9.8CriticalEPSS2.34%PrioritiseCVE-2012-2926atlassian · bamboo +6 moreatlassian bambooAtlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.CVSS9.1CriticalEPSS66.26%