Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2017-18087

The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
atlassian

Description

The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version 5.4.0 before version 5.4.1 allows remote attackers to write files to disk potentially allowing them to gain code execution, exploit CVE-2017-1000117 if a vulnerable version of git is in use, and or determine if an internal service exists via an argument injection vulnerability in the at parameter.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Atlassian Bitbucket Server

  • from 5.1.0 prior to 5.1.7affected
  • from 5.2.0 prior to 5.2.5affected
  • from 5.3.0 prior to 5.3.3affected
  • from 5.4.0 prior to 5.4.1affected

References