CVE-2014-9757

CVE Database · CVE-2014-9757

CVE-2014-9757

· N/AModified

CVSS v3.1

N/A

EPSS

2.34%

Published

Feb 8, 2016

Modified

May 6, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitrary Java code via serialized data in an XMPP message.

Weaknesses (CWE)

CWE-20

Affected Products (90)

atlassian · bamboovulnerable

References (8)

http://packetstormsecurity.com/files/135352/Bamboo-Deserialization-Missing-Authentication-Checks.html

http://www.securityfocus.com/archive/1/537347/100/0/threaded

https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2016-01-20-794376535.html

Vendor Advisory

https://jira.atlassian.com/browse/BAM-17099

PatchVendor Advisory