CVE-2015-6576 Code injection in n/a

What is CVE-2015-6576?

CVE-2015-6576 is a high-severity code injection vulnerability in n/a, published on 2 Oct 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecified resource.

Weakness: CWE-94

Which versions are affected by CVE-2015-6576?

It affects 1 product.

Products include Atlassian Bamboo.

How do I fix CVE-2015-6576?

No fix has been published for CVE-2015-6576 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2015-6576 being exploited?

There is no known exploitation of CVE-2015-6576 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Exploited Critical 9.3
• CVE-2022-26136 Auth bypass in Bamboo Data Center Critical 9.8
• CVE-2016-5229 Deserialization in n/a Critical 9.8
• CVE-2014-9757 Deserialization in n/a Critical 9.8
• CVE-2015-8360 Deserialization in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wq88-7mxf-ggcp.