Bamboo vulnerabilitiesRanked by how likely they are to be used.
Bamboo is made by Atlassian. We track 24 published vulnerabilities listed under that exact name, across 266 versions. None of them is on the list of flaws known to be exploited today. Atlassian lists newer releases under their own names, such as Bamboo Data Center, so check those pages too.
We keep watching the known-exploited list.
Is Bamboo listed under other names? Yes.
Atlassian also lists Bamboo under more specific names, such as Bamboo Data Center and Bamboo Server. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
Which Bamboo vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Bamboo's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Bamboo flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 7.1%CVE-2016-5229Critical
Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via vectors related to XStream Serialization.
- 5.7%CVE-2022-26136Critical
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps.
- 3.7%CVE-2015-6576High
Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecified resource.
- 3.0%CVE-2015-8360Critical
An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.
- 2.8%CVE-2015-8361Critical
Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote attackers to obtain sensitive information, modify settings, or manage build...
- 2.7%CVE-2018-5224High
Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters.
- 2.7%CVE-2024-21689High
This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server.
- 2.4%CVE-2022-26137High
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses.
- 2.4%CVE-2017-14590Critical
Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters.
Running Bamboo? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
- Matched to
- Bamboo on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 24 published vulnerabilities listed under the name Bamboo, across 266 versions.
None of Bamboo's vulnerabilities is on the list of flaws known to be exploited today.
Atlassian also lists Bamboo under more specific names, such as Bamboo Data Center and Bamboo Server. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Create a Precursor Intelligence account and track Bamboo. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.