Lucene search

MitreCVE-2015-8361

HistoryFeb 08, 2016 - 7:59 p.m.

CVE-2015-8361

2016-02-0819:59:04

CWE-284

mitre

web.nvd.nist.gov

cve-2015-8361

atlassian bamboo

unauthorized access

vulnerability

jms port

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.1

Confidence

High

EPSS

0.003

Percentile

71.5%

JSON

Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote attackers to obtain sensitive information, modify settings, or manage build agents via unknown vectors involving the JMS port.

Affected configurations

Nvd

Node

atlassianbambooMatch2.4

atlassianbambooMatch2.4.1

atlassianbambooMatch2.4.2

atlassianbambooMatch2.4.3

atlassianbambooMatch2.5

atlassianbambooMatch2.5.1

atlassianbambooMatch2.5.2

atlassianbambooMatch2.5.3

atlassianbambooMatch2.5.5

atlassianbambooMatch2.6

atlassianbambooMatch2.6.1

atlassianbambooMatch2.6.2

atlassianbambooMatch2.6.3

atlassianbambooMatch2.7

atlassianbambooMatch2.7.1

atlassianbambooMatch2.7.2

atlassianbambooMatch2.7.3

atlassianbambooMatch2.7.4

atlassianbambooMatch3.0

atlassianbambooMatch3.0.1

atlassianbambooMatch3.0.2

atlassianbambooMatch3.0.3

atlassianbambooMatch3.1

atlassianbambooMatch3.1.1

atlassianbambooMatch3.1.3

atlassianbambooMatch3.1.4

atlassianbambooMatch3.2

atlassianbambooMatch3.2.2

atlassianbambooMatch3.3

atlassianbambooMatch3.3.1

atlassianbambooMatch3.3.2

atlassianbambooMatch3.3.3

atlassianbambooMatch3.3.4

atlassianbambooMatch3.4

atlassianbambooMatch3.4.1

atlassianbambooMatch3.4.2

atlassianbambooMatch3.4.3

atlassianbambooMatch3.4.4

atlassianbambooMatch3.4.5

atlassianbambooMatch4.0

atlassianbambooMatch4.0.1

atlassianbambooMatch4.1

atlassianbambooMatch4.1.1

atlassianbambooMatch4.1.2

atlassianbambooMatch4.2

atlassianbambooMatch4.2.1

atlassianbambooMatch4.3

atlassianbambooMatch4.3.1

atlassianbambooMatch4.3.2

atlassianbambooMatch4.3.3

atlassianbambooMatch4.3.4

atlassianbambooMatch4.4

atlassianbambooMatch4.4.1

atlassianbambooMatch4.4.2

atlassianbambooMatch4.4.3

atlassianbambooMatch4.4.4

atlassianbambooMatch4.4.5

atlassianbambooMatch4.4.8

atlassianbambooMatch5.0

atlassianbambooMatch5.0beta1

atlassianbambooMatch5.0beta2

atlassianbambooMatch5.0beta3

atlassianbambooMatch5.0rc1

atlassianbambooMatch5.0.1

atlassianbambooMatch5.1

atlassianbambooMatch5.1.1

atlassianbambooMatch5.2

atlassianbambooMatch5.2.1

atlassianbambooMatch5.2.2

atlassianbambooMatch5.3

atlassianbambooMatch5.4

atlassianbambooMatch5.4.1

atlassianbambooMatch5.4.2

atlassianbambooMatch5.5

atlassianbambooMatch5.6

atlassianbambooMatch5.6.1

atlassianbambooMatch5.6.2

atlassianbambooMatch5.7

atlassianbambooMatch5.7.1

atlassianbambooMatch5.7.2

atlassianbambooMatch5.8

atlassianbambooMatch5.8.1

atlassianbambooMatch5.8.2

atlassianbambooMatch5.8.5

atlassianbambooMatch5.9

atlassianbambooMatch5.9.1

atlassianbambooMatch5.9.2

atlassianbambooMatch5.9.3

atlassianbambooMatch5.9.4

atlassianbambooMatch5.9.7

VendorProductVersionCPE
atlassianbamboo2.4cpe:2.3:a:atlassian:bamboo:2.4:*:*:*:*:*:*:*
atlassianbamboo2.4.1cpe:2.3:a:atlassian:bamboo:2.4.1:*:*:*:*:*:*:*
atlassianbamboo2.4.2cpe:2.3:a:atlassian:bamboo:2.4.2:*:*:*:*:*:*:*
atlassianbamboo2.4.3cpe:2.3:a:atlassian:bamboo:2.4.3:*:*:*:*:*:*:*
atlassianbamboo2.5cpe:2.3:a:atlassian:bamboo:2.5:*:*:*:*:*:*:*
atlassianbamboo2.5.1cpe:2.3:a:atlassian:bamboo:2.5.1:*:*:*:*:*:*:*
atlassianbamboo2.5.2cpe:2.3:a:atlassian:bamboo:2.5.2:*:*:*:*:*:*:*
atlassianbamboo2.5.3cpe:2.3:a:atlassian:bamboo:2.5.3:*:*:*:*:*:*:*
atlassianbamboo2.5.5cpe:2.3:a:atlassian:bamboo:2.5.5:*:*:*:*:*:*:*
atlassianbamboo2.6cpe:2.3:a:atlassian:bamboo:2.6:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
atlassian	bamboo	2.4	cpe:2.3:a:atlassian:bamboo:2.4:::::::*
atlassian	bamboo	2.4.1	cpe:2.3:a:atlassian:bamboo:2.4.1:::::::*
atlassian	bamboo	2.4.2	cpe:2.3:a:atlassian:bamboo:2.4.2:::::::*
atlassian	bamboo	2.4.3	cpe:2.3:a:atlassian:bamboo:2.4.3:::::::*
atlassian	bamboo	2.5	cpe:2.3:a:atlassian:bamboo:2.5:::::::*
atlassian	bamboo	2.5.1	cpe:2.3:a:atlassian:bamboo:2.5.1:::::::*
atlassian	bamboo	2.5.2	cpe:2.3:a:atlassian:bamboo:2.5.2:::::::*
atlassian	bamboo	2.5.3	cpe:2.3:a:atlassian:bamboo:2.5.3:::::::*
atlassian	bamboo	2.5.5	cpe:2.3:a:atlassian:bamboo:2.5.5:::::::*
atlassian	bamboo	2.6	cpe:2.3:a:atlassian:bamboo:2.6:::::::*

Rows per page:

1-10 of 901

References

packetstormsecurity.com/files/135352/Bamboo-Deserialization-Missing-Authentication-Checks.html

www.securityfocus.com/archive/1/537347/100/0/threaded

confluence.atlassian.com/bamboo/bamboo-security-advisory-2016-01-20-794376535.html

jira.atlassian.com/browse/BAM-17102

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.1

Confidence

High

EPSS

0.003

Percentile

71.5%

JSON

Related for CVE-2015-8361