Description
The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from version 5.0.0 before 5.0.9 (the fixed version for 5.0.x), from version 5.1.0 before 5.1.8 (the fixed version for 5.1.x), from version 5.2.0 before 5.2.6 (the fixed version for 5.2.x), from version 5.3.0 before 5.3.4 (the fixed version for 5.3.x), from version 5.4.0 before 5.4.2 (the fixed version for 5.4.x), from version 5.5.0 before 5.5.1 (the fixed version for 5.5.x) and before 5.6.0 allows remote attackers to read arbitrary files via a path traversal vulnerability through the name of a git tag.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Atlassian Bitbucket Server
from 3.7.0 prior to 4.14.11affectedfrom 5.0.0 prior to 5.0.9affectedfrom 5.1.0 prior to 5.1.8affectedfrom 5.2.0 prior to 5.2.6affectedfrom 5.3.0 prior to 5.3.4affectedfrom 5.4.0 prior to 5.4.2affectedfrom 5.5.0 prior to 5.5.1affected