Remote Code Execution Vulnerability in Bitbucket Server and Data Center by Atlassian
CVE-2019-20097

8.8HIGH

Key Information:

Vendor
Atlassian
Status
Bitbucket Server
Bitbucket Data Center
Vendor
CVE Published:
15 January 2020

Summary

A vulnerability in Bitbucket Server and Bitbucket Data Center allows remote attackers with certain permissions to exploit the post-receive hook. By uploading a specifically crafted file, an attacker can execute arbitrary commands on the server. This vulnerability affects multiple versions, making it critical for users to update their systems to avoid potential exploits.

Affected Version(s)

Bitbucket Data Center 1.0

Bitbucket Data Center < 5.16.11

Bitbucket Data Center 6.0

References

https://jira.atlassian.com/browse/BSERV-12099
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.