Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2018-5225

In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
atlassian

Description

In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x), allows authenticated users to gain remote code execution using the in browser editing feature via editing a symbolic link within a repository.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Atlassian Bitbucket Server

  • 4.13.0 to < unspecifiedaffected
  • unspecified to < 5.4.8affected
  • 5.5.0 to < unspecifiedaffected
  • unspecified to < 5.5.8affected
  • 5.6.0 to < unspecifiedaffected
  • unspecified to < 5.6.5affected
  • 5.7.0 to < unspecifiedaffected
  • unspecified to < 5.7.3affected
  • 5.8.0 to < unspecifiedaffected
  • unspecified to < 5.8.2affected

References