Bamboo had a resource that deserialised arbitrary user input without restriction. Attackers can use this vulnerability to execute Java code of their choice on systems that have a vulnerable version of Bamboo. To exploit this issue, attackers need to be able to access the Bamboo web interface.
Affected versions:
Fix:
\
Acknowledgements:
We would like to credit Matthias Kaiser of [Code White|http://www.code-white.com/] for reporting this issue to us.
\
For additional details see the [full advisory|https://confluence.atlassian.com/x/Hw7RLg].