CVE-2016-5229

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via vectors related to XStream Serialization.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/138053/Bamboo-Deserialization-Issue.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/539003/100/0/threaded
http://www.securityfocus.com/bid/92057Third Party Advisory, VDB Entry
https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2016-07-20-831660461.htmlVendor Advisory
https://jira.atlassian.com/browse/BAM-17736Issue Tracking
http://packetstormsecurity.com/files/138053/Bamboo-Deserialization-Issue.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/539003/100/0/threaded
http://www.securityfocus.com/bid/92057Third Party Advisory, VDB Entry
https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2016-07-20-831660461.htmlVendor Advisory
https://jira.atlassian.com/browse/BAM-17736Issue Tracking

Timeline

Published: Aug 2, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-52308.8Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 CVE-2016-52317.8Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 CVE-2016-52325.5Buffer overflow in Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL befo CVE-2016-52333.7Huawei Mate 8 smartphones with software NXT-AL10 before NXT-AL10C00B182, NXT-CL00 before NXT-CL00C92B182, NXT-DL00 before NXT-DL00C17B182, a CVE-2016-52348.1Buffer overflow in Huawei VP9660, VP9650, and VP9630 multipoint control unit devices with software before V500R002C00SPC200 and RSE6500 vide CVE-2016-52356.1A Cross Site Scripting (XSS) vulnerability in versions of F5 WebSafe Dashboard 3.9.x and earlier, aka F5 WebSafe Alert Server, allows an una CVE-2016-52365.4Cross-Site-Scripting (XSS) vulnerabilities in F5 WebSafe Dashboard 3.9.5 and earlier, aka F5 WebSafe Alert Server, allow privileged authenti CVE-2016-52374.8Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to modify the files and CVE-2016-52384.4The get_cmd function in hw/scsi/esp.c in QEMU might allow local guest OS administrators to cause a denial of service (out-of-bounds write an CVE-2016-52399.8The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands vi CVE-2016-52405.5The DrawDashPolygon function in magick/render.c in GraphicsMagick before 1.3.24 and the SVG renderer in ImageMagick allow remote attackers t CVE-2016-52415.5magick/render.c in GraphicsMagick before 1.3.24 allows remote attackers to cause a denial of service (arithmetic exception and application c