CVE Daily – Bamboo (High+Critical) https://cvedaily.com/pages/tags/bamboo.html CVE Daily – Bamboo (High+Critical) en Wed, 03 Jun 2026 21:26:55 +0000 [Critical] CVE-2026-21571 – This Critical severity OS Command Injection vulnerability was introduced in vers... https://nvd.nist.gov/vuln/detail/CVE-2026-21571 https://nvd.nist.gov/vuln/detail/CVE-2026-21571 Tue, 21 Apr 2026 17:16:22 +0000 Critical CVE-2026-21571

This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.   This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 9.4 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H allows an authenticated attacker to execute commands on the…

CVSS: 9.4 · CWE: CWE-78

View on NVD

]]> [High] CVE-2026-21570 – This High severity RCE (Remote Code Execution)  vulnerability was introduced in ... https://nvd.nist.gov/vuln/detail/CVE-2026-21570 https://nvd.nist.gov/vuln/detail/CVE-2026-21570 Tue, 17 Mar 2026 18:16:14 +0000 High CVE-2026-21570

This High severity RCE (Remote Code Execution)  vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.6, allows an authenticated attacker to execute malicious code on the remote system. Atlassian recommends that Bamboo Data Center customers upgra…

CVSS: 8.6 · CWE: CWE-94

View on NVD

]]> [High] CVE-2024-21689 – This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689  was... https://nvd.nist.gov/vuln/detail/CVE-2024-21689 https://nvd.nist.gov/vuln/detail/CVE-2024-21689 Tue, 20 Aug 2024 10:15:04 +0000 High CVE-2024-21689

This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689  was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact…

CVSS: 8.0 · CWE: CWE-94

View on NVD

]]> [High] CVE-2024-21687 – This High severity File Inclusion vulnerability was introduced in versions 9.0.0... https://nvd.nist.gov/vuln/detail/CVE-2024-21687 https://nvd.nist.gov/vuln/detail/CVE-2024-21687 Tue, 16 Jul 2024 21:15:10 +0000 High CVE-2024-21687

This High severity File Inclusion vulnerability was introduced in versions 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 and 9.6.0 of Bamboo Data Center and Server. This File Inclusion vulnerability, with a CVSS Score of 8.1, allows an authenticated attacker to get the application to display the contents of a local file, or execute a different files already stored locally on the server which has high…

CVSS: 8.1 · CWE: CWE-98

View on NVD

]]> [High] CVE-2023-22516 – This High severity RCE (Remote Code Execution) vulnerability was introduced in v... https://nvd.nist.gov/vuln/detail/CVE-2023-22516 https://nvd.nist.gov/vuln/detail/CVE-2023-22516 Tue, 21 Nov 2023 18:15:07 +0000 High CVE-2023-22516

This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.0, and 9.3.0 of Bamboo Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability,…

CVSS: 8.8 · CWE: N/A

View on NVD

]]> [High] CVE-2023-22506 – This High severity Injection and RCE (Remote Code Execution) vulnerability known... https://nvd.nist.gov/vuln/detail/CVE-2023-22506 https://nvd.nist.gov/vuln/detail/CVE-2023-22506 Wed, 19 Jul 2023 00:15:09 +0000 High CVE-2023-22506

This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo Data Center.   This Injection and RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.5, allows an authenticated attacker to modify the actions taken by a system call and execute arbitrary code which has high impact to confidentiality, high im…

CVSS: 8.8 · CWE: CWE-94

View on NVD

]]> [High] CVE-2022-26137 – A vulnerability in multiple Atlassian products allows a remote, unauthenticated ... https://nvd.nist.gov/vuln/detail/CVE-2022-26137 https://nvd.nist.gov/vuln/detail/CVE-2022-26137 Wed, 20 Jul 2022 18:15:08 +0000 High CVE-2022-26137

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servl…

CVSS: 8.8 · CWE: CWE-180

View on NVD

]]> [Critical] CVE-2022-26136 – A vulnerability in multiple Atlassian products allows a remote, unauthenticated ... https://nvd.nist.gov/vuln/detail/CVE-2022-26136 https://nvd.nist.gov/vuln/detail/CVE-2022-26136 Wed, 20 Jul 2022 18:15:08 +0000 Critical CVE-2022-26136

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, b…

CVSS: 9.8 · CWE: CWE-180

View on NVD

]]> [Critical] CVE-2021-37843 – The resolution SAML SSO apps for Atlassian products allow a remote attacker to l... https://nvd.nist.gov/vuln/detail/CVE-2021-37843 https://nvd.nist.gov/vuln/detail/CVE-2021-37843 Mon, 02 Aug 2021 19:15:08 +0000 Critical CVE-2021-37843

The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known (i.e., no other authentication is provided). The fixed versions are for Jira: 3.6.6.1, 4.0.12, 5.0.5; for Confluence 3.6.6, 4.0.12, 5.0.5; for Bitbucket 2.5.9, 3.6.6, 4.0.12, 5.0.5; for Bamboo 2.5.9, 3.6.6, 4.0.12, 5.0.5; and for Fisheye 2.5.9.

CVSS: 9.8 · CWE: CWE-306

View on NVD

]]> [High] CVE-2019-13347 – An issue was discovered in the SAML Single Sign On (SSO) plugin for several Atla... https://nvd.nist.gov/vuln/detail/CVE-2019-13347 https://nvd.nist.gov/vuln/detail/CVE-2019-13347 Fri, 13 Dec 2019 13:15:11 +0000 High CVE-2019-13347

An issue was discovered in the SAML Single Sign On (SSO) plugin for several Atlassian products affecting versions 3.1.0 through 3.2.2 for Jira and Confluence, versions 2.4.0 through 3.0.3 for Bitbucket, and versions 2.4.0 through 2.5.2 for Bamboo. It allows locally disabled users to reactivate their accounts just by browsing the affected Jira/Confluence/Bitbucket/Bamboo instance, even when the ap…

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2018-5224 – Bamboo did not correctly check if a configured Mercurial repository URI containe... https://nvd.nist.gov/vuln/detail/CVE-2018-5224 https://nvd.nist.gov/vuln/detail/CVE-2018-5224 Thu, 29 Mar 2018 13:29:00 +0000 High CVE-2018-5224

Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to create a repository in Bamboo, edit an existing plan in Bamboo that has a non-linked Mercurial repository, or create a plan in Bamboo either globally or in a project using Bamboo Specs can can execute code of…

CVSS: 8.8 · CWE: CWE-20

View on NVD

]]> [High] CVE-2017-18080 – The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allo... https://nvd.nist.gov/vuln/detail/CVE-2017-18080 https://nvd.nist.gov/vuln/detail/CVE-2017-18080 Fri, 02 Feb 2018 14:29:01 +0000 High CVE-2017-18080

The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross-site request forgery (CSRF) vulnerability.

CVSS: 8.8 · CWE: CWE-352

View on NVD

]]> [High] CVE-2017-18042 – The update user administration resource in Atlassian Bamboo before version 6.3.1... https://nvd.nist.gov/vuln/detail/CVE-2017-18042 https://nvd.nist.gov/vuln/detail/CVE-2017-18042 Fri, 02 Feb 2018 14:29:00 +0000 High CVE-2017-18042

The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-site request forgery (CSRF) vulnerability.

CVSS: 8.8 · CWE: CWE-352

View on NVD

]]> [Critical] CVE-2017-14590 – Bamboo did not check that the name of a branch in a Mercurial repository contain... https://nvd.nist.gov/vuln/detail/CVE-2017-14590 https://nvd.nist.gov/vuln/detail/CVE-2017-14590 Wed, 13 Dec 2017 15:29:00 +0000 Critical CVE-2017-14590

Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who has permission to create a repository in Bamboo, edit an existing plan that has a non-linked Mercurialrepository, create or edit a plan when there is at least one linked Mercurial repository that the attacker has permission to use, or commit to a Mercurial repository used by a B…

CVSS: 9.1 · CWE: N/A

View on NVD

]]> [Critical] CVE-2017-14589 – It was possible for double OGNL evaluation in FreeMarker templates through Strut... https://nvd.nist.gov/vuln/detail/CVE-2017-14589 https://nvd.nist.gov/vuln/detail/CVE-2017-14589 Wed, 13 Dec 2017 15:29:00 +0000 Critical CVE-2017-14589

It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted administration rights to Bamboo or who hosts a website that a Bamboo administrator visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Bamboo. All versions of Bamboo before 6.1.6 (the f…

CVSS: 9.6 · CWE: CWE-20

View on NVD

]]> [High] CVE-2017-9514 – Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpo... https://nvd.nist.gov/vuln/detail/CVE-2017-9514 https://nvd.nist.gov/vuln/detail/CVE-2017-9514 Thu, 12 Oct 2017 13:29:00 +0000 High CVE-2017-9514

Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. An attacker who can log in to Bamboo as a user is able to exploit this vulnerability to execute Java code of their choice on systems that have vulnerable versions of Bamboo.

CVSS: 8.8 · CWE: CWE-732

View on NVD

]]> [High] CVE-2015-6576 – Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with acce... https://nvd.nist.gov/vuln/detail/CVE-2015-6576 https://nvd.nist.gov/vuln/detail/CVE-2015-6576 Tue, 03 Oct 2017 01:29:00 +0000 High CVE-2015-6576

Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecified resource.

CVSS: 8.8 · CWE: CWE-94

View on NVD

]]> [High] CVE-2017-8907 – Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check ... https://nvd.nist.gov/vuln/detail/CVE-2017-8907 https://nvd.nist.gov/vuln/detail/CVE-2017-8907 Wed, 14 Jun 2017 20:29:00 +0000 High CVE-2017-8907

Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project…

CVSS: 8.8 · CWE: CWE-863

View on NVD

]]> [Critical] CVE-2016-5229 – Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly re... https://nvd.nist.gov/vuln/detail/CVE-2016-5229 https://nvd.nist.gov/vuln/detail/CVE-2016-5229 Tue, 02 Aug 2016 16:59:02 +0000 Critical CVE-2016-5229

Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via vectors related to XStream Serialization.

CVSS: 9.8 · CWE: CWE-284

View on NVD

]]> [Critical] CVE-2015-8361 – Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before... https://nvd.nist.gov/vuln/detail/CVE-2015-8361 https://nvd.nist.gov/vuln/detail/CVE-2015-8361 Mon, 08 Feb 2016 19:59:04 +0000 Critical CVE-2015-8361

Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote attackers to obtain sensitive information, modify settings, or manage build agents via unknown vectors involving the JMS port.

CVSS: 9.1 · CWE: CWE-284

View on NVD

]]> [Critical] CVE-2015-8360 – An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10... https://nvd.nist.gov/vuln/detail/CVE-2015-8360 https://nvd.nist.gov/vuln/detail/CVE-2015-8360 Mon, 08 Feb 2016 19:59:03 +0000 Critical CVE-2015-8360

An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.

CVSS: 9.8 · CWE: CWE-20

View on NVD

]]> [Critical] CVE-2014-9757 – The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and... https://nvd.nist.gov/vuln/detail/CVE-2014-9757 https://nvd.nist.gov/vuln/detail/CVE-2014-9757 Mon, 08 Feb 2016 19:59:00 +0000 Critical CVE-2014-9757

The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitrary Java code via serialized data in an XMPP message.

CVSS: 9.8 · CWE: CWE-20

View on NVD

]]> [Critical] CVE-2012-2926 – Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1... https://nvd.nist.gov/vuln/detail/CVE-2012-2926 https://nvd.nist.gov/vuln/detail/CVE-2012-2926 Tue, 22 May 2012 15:55:02 +0000 Critical CVE-2012-2926

Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows r…

CVSS: 9.1 · CWE: N/A

View on NVD

]]>