NVD

Id
20561  
Name
CVE-2016-5229  
Description
Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via vectors related to XStream Serialization.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-08-02  
Modified Date
2016-08-03  
Seq
2016-5229  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
112530 20561 CVE-2016-5229 http://packetstormsecurity.com/files/138053/Bamboo-Deserialization-Issue.html  View
112531 20561 CVE-2016-5229 20160726 July 2016 - Bamboo Server - Critical Security Advisory  View
112532 20561 CVE-2016-5229 92057  View
112533 20561 CVE-2016-5229 https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2016-07-20-831660461.html  View
112534 20561 CVE-2016-5229 https://jira.atlassian.com/browse/BAM-17736  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
3348 JVNDB-2016-004121 Atlassian Bamboo における任意のコードを実行される脆弱性 Atlassian Bamboo は、許可されたデシリアライズされたクラスを適切に制限しないため、任意のコードを実行される脆弱性が存在します。 CVE-2016-5229 91735 CVE-2016-5229 20561 7.5 9.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004121.html 2016-07-07 2016-08-04 View