Lucene search

[email protected]CVE-2017-18037

HistoryFeb 02, 2018 - 2:29 p.m.

CVE-2017-18037

2018-02-0214:29:00

CWE-22

[email protected]

web.nvd.nist.gov

atlassian

bitbucket server

cve-2017-18037

path traversal

git

remote attack

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.4 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.5%

JSON

The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from version 5.0.0 before 5.0.9 (the fixed version for 5.0.x), from version 5.1.0 before 5.1.8 (the fixed version for 5.1.x), from version 5.2.0 before 5.2.6 (the fixed version for 5.2.x), from version 5.3.0 before 5.3.4 (the fixed version for 5.3.x), from version 5.4.0 before 5.4.2 (the fixed version for 5.4.x), from version 5.5.0 before 5.5.1 (the fixed version for 5.5.x) and before 5.6.0 allows remote attackers to read arbitrary files via a path traversal vulnerability through the name of a git tag.

Affected configurations

NVD

Node

atlassianbitbucketRange3.7.0–4.14.11

atlassianbitbucketRange5.0.0–5.0.9

atlassianbitbucketRange5.1.0–5.1.8

atlassianbitbucketRange5.2.0–5.2.6

atlassianbitbucketRange5.3.0–5.3.4

atlassianbitbucketRange5.4.0–5.4.2

atlassianbitbucketMatch5.5.0

atlassianbitbucketMatch5.5.2

atlassianbitbucketMatch5.5.3

atlassianbitbucketMatch5.5.4

atlassianbitbucketMatch5.5.5

atlassianbitbucketMatch5.5.6

CPENameOperatorVersion
atlassian:bitbucketatlassian bitbucketlt4.14.11
atlassian:bitbucketatlassian bitbucketlt5.0.9
atlassian:bitbucketatlassian bitbucketlt5.1.8
atlassian:bitbucketatlassian bitbucketlt5.2.6
atlassian:bitbucketatlassian bitbucketlt5.3.4
atlassian:bitbucketatlassian bitbucketlt5.4.2
atlassian:bitbucketatlassian bitbucketeq5.5.0
atlassian:bitbucketatlassian bitbucketeq5.5.2
atlassian:bitbucketatlassian bitbucketeq5.5.3
atlassian:bitbucketatlassian bitbucketeq5.5.4

CPE	Name	Operator	Version
atlassian:bitbucket	atlassian bitbucket	lt	4.14.11
atlassian:bitbucket	atlassian bitbucket	lt	5.0.9
atlassian:bitbucket	atlassian bitbucket	lt	5.1.8
atlassian:bitbucket	atlassian bitbucket	lt	5.2.6
atlassian:bitbucket	atlassian bitbucket	lt	5.3.4
atlassian:bitbucket	atlassian bitbucket	lt	5.4.2
atlassian:bitbucket	atlassian bitbucket	eq	5.5.0
atlassian:bitbucket	atlassian bitbucket	eq	5.5.2
atlassian:bitbucket	atlassian bitbucket	eq	5.5.3
atlassian:bitbucket	atlassian bitbucket	eq	5.5.4

Rows per page:

1-10 of 121

CNA Affected

[
  {
    "product": "Bitbucket Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "status": "affected",
        "version": "from 3.7.0 prior to 4.14.11"
      },
      {
        "status": "affected",
        "version": "from 5.0.0 prior to 5.0.9"
      },
      {
        "status": "affected",
        "version": "from 5.1.0 prior to 5.1.8"
      },
      {
        "status": "affected",
        "version": "from 5.2.0 prior to 5.2.6"
      },
      {
        "status": "affected",
        "version": "from 5.3.0 prior to 5.3.4"
      },
      {
        "status": "affected",
        "version": "from 5.4.0 prior to 5.4.2"
      },
      {
        "status": "affected",
        "version": "from 5.5.0 prior to 5.5.1"
      }
    ]
  }
]

References

jira.atlassian.com/browse/BSERV-10595

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.4 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.5%

JSON

Related for CVE-2017-18037

atlassian2 prion1 nvd1 cvelist1