---
cve: "CVE-2016-5229"
severity: "LOW"
cvss: 3.1
epss: "7.1%"
vendor: "n/a"
kev: false
exploited: false
published: "2016-08-02 16:59:02"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-18T17:25:18+02:00"
---

# CVE-2016-5229

> 3.1 LOW · 🧪 PoC

## Beschreibung

Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via vectors related to XStream Serialization.

## Referenzen

- <http://www.securityfocus.com/archive/1/539003/100/0/threaded>
- <http://packetstormsecurity.com/files/138053/Bamboo-Deserialization-Issue.html>
- <http://www.securityfocus.com/bid/92057>
- <https://jira.atlassian.com/browse/BAM-17736>
- <https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2016-07-20-831660461.html>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2016-5229) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_