Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java cod

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• atlassian bamboo2.2 and later · before 5.8.5
• atlassian bamboo5.9 and later · before 5.9.7

Other highest-scoring records for the same primary product.

• CVE-2012-2926Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 befor
  56Plan
• CVE-2022-26136A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third p
  41Plan
• CVE-2016-5229Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote a
  41Plan
• CVE-2015-8360An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via
  40Plan
• CVE-2014-9757The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers
  40Plan
• CVE-2017-14589It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur.
  39Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.