{"id":"CVE-2020-36233","state":"PUBLISHED","title":"The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers ","description":"The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.","publishedAt":"2021-02-18T15:16:22.101Z","updatedAt":"2024-09-16T19:30:12.974Z","severity":null,"assigner":"atlassian","products":["Atlassian Bitbucket Server","Atlassian Bitbucket Data Center"],"affected":[{"vendor":"Atlassian","product":"Bitbucket Server","versions":[{"version":"unspecified","status":"affected","lessThan":"6.10.9","versionType":"custom"},{"version":"7.0.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.6.4","versionType":"custom"},{"version":"7.7.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.10.1","versionType":"custom"}]},{"vendor":"Atlassian","product":"Bitbucket Data Center","versions":[{"version":"unspecified","status":"affected","lessThan":"6.10.9","versionType":"custom"},{"version":"7.0.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.6.4","versionType":"custom"},{"version":"7.7.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.10.1","versionType":"custom"}]}],"references":["https://jira.atlassian.com/browse/BSERV-12753","https://www.kb.cert.org/vuls/id/240785"],"weaknesses":[],"ingestedAt":"2026-10-29T19:47:24.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/36xxx/CVE-2020-36233.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-36233","state":"PUBLISHED","datePublished":"2021-02-18T15:16:22.101Z","dateUpdated":"2024-09-16T19:30:12.974Z","assignerShortName":"atlassian","assignerOrgId":"f08a6ab8-ed46-4c22-8884-d911ccfe3c66","dateReserved":"2021-01-27T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory."}],"affected":[{"vendor":"Atlassian","product":"Bitbucket Server","versions":[{"version":"unspecified","status":"affected","lessThan":"6.10.9","versionType":"custom"},{"version":"7.0.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.6.4","versionType":"custom"},{"version":"7.7.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.10.1","versionType":"custom"}]},{"vendor":"Atlassian","product":"Bitbucket Data Center","versions":[{"version":"unspecified","status":"affected","lessThan":"6.10.9","versionType":"custom"},{"version":"7.0.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.6.4","versionType":"custom"},{"version":"7.7.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.10.1","versionType":"custom"}]}],"references":[{"url":"https://jira.atlassian.com/browse/BSERV-12753","tags":["x_refsource_MISC"]},{"url":"https://www.kb.cert.org/vuls/id/240785","name":"VU#240785","tags":["third-party-advisory","x_refsource_CERT-VN"]}],"problemTypes":[{"descriptions":[{"description":"Incorrect Permission Assignment for Critical Resource","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"atlassian","dateUpdated":"2021-02-18T19:06:08.000Z","orgId":"f08a6ab8-ed46-4c22-8884-d911ccfe3c66"},"datePublic":"2021-02-16T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@atlassian.com","DATE_PUBLIC":"2021-02-16T00:00:00","ID":"CVE-2020-36233","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Bitbucket Server","version":{"version_data":[{"version_affected":"<","version_value":"6.10.9"},{"version_affected":">=","version_value":"7.0.0"},{"version_affected":"<","version_value":"7.6.4"},{"version_affected":">=","version_value":"7.7.0"},{"version_affected":"<","version_value":"7.10.1"}]}},{"product_name":"Bitbucket Data Center","version":{"version_data":[{"version_affected":"<","version_value":"6.10.9"},{"version_affected":">=","version_value":"7.0.0"},{"version_affected":"<","version_value":"7.6.4"},{"version_affected":">=","version_value":"7.7.0"},{"version_affected":"<","version_value":"7.10.1"}]}}]},"vendor_name":"Atlassian"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Incorrect Permission Assignment for Critical Resource"}]}]},"references":{"reference_data":[{"name":"https://jira.atlassian.com/browse/BSERV-12753","refsource":"MISC","url":"https://jira.atlassian.com/browse/BSERV-12753"},{"name":"VU#240785","refsource":"CERT-VN","url":"https://www.kb.cert.org/vuls/id/240785"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://jira.atlassian.com/browse/BSERV-12753","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.kb.cert.org/vuls/id/240785","name":"VU#240785","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T17:23:09.677Z"}}]}}}