Vulnerability CVE-2014-9757
Published: 2016-02-08

Description:
The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitrary Java code via serialized data in an XMPP message.

See advisories in our WLB2 database:
Topic
Author
Date
High
Bamboo Deserialization / Missing Authentication Checks
David Black
22.01.2016

Type:

CWE-20

 (Improper Input Validation)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Atlassian -> Bamboo 

 References:
http://packetstormsecurity.com/files/135352/Bamboo-Deserialization-Missing-Authentication-Checks.html
http://www.securityfocus.com/archive/1/537347/100/0/threaded
https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2016-01-20-794376535.html
https://jira.atlassian.com/browse/BAM-17099
Copyright 2024, cxsecurity.com

 

Back to Top