CVE-2015-8360

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-02-08 · updated 2026-06-17
Weakness: CWE-20

Description

An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.

Affected products

Atlassian Bamboo: 2.3.1, 2.4, 2.4.1, 2.4.2, 2.4.3, 2.5 (+85)

References

http://packetstormsecurity.com/files/135352/Bamboo-Deserialization-Missing-Authentication-Checks.html
http://www.securityfocus.com/archive/1/537347/100/0/threaded
https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2016-01-20-794376535.html
https://jira.atlassian.com/browse/BAM-17101
http://packetstormsecurity.com/files/135352/Bamboo-Deserialization-Missing-Authentication-Checks.html
http://www.securityfocus.com/archive/1/537347/100/0/threaded
https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2016-01-20-794376535.html
https://jira.atlassian.com/browse/BAM-17101

Get alerted when CVE-2015-8360 or the next vulnerability affects your stack