Bamboo
Vendor:
First CVE: May 22, 2012 · Active for 14 years
24
Total CVEs
More Total CVEs than 96% of tracked products
2.7
Avg CVEs / Year
Higher CVE frequency than 78% of tracked products
8.1
Avg CVSS
Higher Avg CVSS than 73% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Bamboo over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 22, 2012
14 years ago
Most Recent CVE
Aug 20, 2024
706 days ago
CVE Severity & Scoring
Bamboo24 CVEs
25%
42%
33%
All CVEs352,785 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network24 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low24 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None15 (62.5%)
Unknown0 (0.0%)
Required9 (37.5%)
Privileges Required
Low11 (45.8%)
High1 (4.2%)
None12 (50.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (24 CVEs).
24 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-2926CRITICAL Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo b | May 22, 2012 | 9.1 | 82 | NO | YES |
CVE-2022-26136CRITICAL A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which f | Jul 20, 2022 | 9.8 | 34 | NO | NO |
CVE-2016-5229CRITICAL Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via v | Aug 2, 2016 | 9.8 | 33 | NO | NO |
CVE-2017-14589CRITICAL It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted administration rights to Bamboo or who ho | Dec 13, 2017 | 9.6 | 30 | NO | NO |
CVE-2014-9757CRITICAL The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitrary Java code via seri | Feb 8, 2016 | 9.8 | 30 | NO | NO |
CVE-2022-26137HIGH A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests o | Jul 20, 2022 | 8.8 | 29 | NO | NO |
CVE-2018-5224HIGH Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has per | Mar 29, 2018 | 8.8 | 29 | NO | NO |
CVE-2017-14590CRITICAL Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who has permission to create a repository in Bamboo, edit an exi | Dec 13, 2017 | 9.1 | 29 | NO | NO |
CVE-2017-9514HIGH Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. An atta | Oct 12, 2017 | 8.8 | 28 | NO | NO |
CVE-2017-8907HIGH Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. | Jun 14, 2017 | 8.8 | 27 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (24 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
1 CVE
4.2% of CVEs· 97th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
4.2% of CVEs· 85th percentile
Social Chatter
Signals from CVEs in this product scope (24 CVEs).
Media Mentions
Signals from CVEs in this product scope (24 CVEs).
Top CNAs Publishing CVEs For Bamboo
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 6.2.0 | 1 | 8.8 | 1.1% | 0 | 0 |
| 6.1.1 | 1 | 8.8 | 1.1% | 0 | 0 |
| 6.1.0 | 1 | 8.8 | 1.1% | 0 | 0 |
| 6.0.4 | 1 | 8.8 | 1.1% | 0 | 0 |
| 6.0.3 | 1 | 8.8 | 1.1% | 0 | 0 |
| 6.0.2 | 1 | 8.8 | 1.1% | 0 | 0 |
| 6.0.1 | 1 | 8.8 | 1.1% | 0 | 0 |
| 6.0.0 | 2 | 8.8 | 1.3% | 0 | 0 |
| 5.9.7 | 4 | 9.4 | 2.5% | 0 | 0 |
| 5.9.4 | 4 | 9.4 | 2.5% | 0 | 0 |
| 5.9.3 | 4 | 9.4 | 2.5% | 0 | 0 |
| 5.9.2 | 4 | 9.4 | 2.5% | 0 | 0 |
| 5.9.1 | 4 | 9.4 | 2.5% | 0 | 0 |
| 5.9 | 4 | 9.4 | 2.5% | 0 | 0 |
| 5.8.5 | 4 | 9.4 | 2.5% | 0 | 0 |
| 5.8.2 | 4 | 9.4 | 2.5% | 0 | 0 |
| 5.8.1 | 4 | 9.4 | 2.5% | 0 | 0 |
| 5.8 | 4 | 9.4 | 2.5% | 0 | 0 |
| 5.7.2 | 4 | 9.4 | 2.5% | 0 | 0 |
| 5.7.1 | 4 | 9.4 | 2.5% | 0 | 0 |