Lucene search

[email protected]CVE-2020-36233

HistoryFeb 18, 2021 - 8:15 p.m.

CVE-2020-36233

2021-02-1820:15:12

CWE-276

[email protected]

web.nvd.nist.gov

nvd

cve-2020-36233

microsoft windows

atlassian bitbucket

server

data center

local attackers

privilege escalation

weak permissions

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

0.4%

JSON

The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.

Affected configurations

NVD

Node

atlassianbitbucketRange<6.10.9

atlassianbitbucketRange7.0.0–7.6.4

atlassianbitbucketRange7.7.0–7.10.1

AND

microsoftwindowsMatch-

CPENameOperatorVersion
atlassian:bitbucketatlassian bitbucketlt6.10.9
atlassian:bitbucketatlassian bitbucketlt7.6.4
atlassian:bitbucketatlassian bitbucketlt7.10.1

CPE	Name	Operator	Version
atlassian:bitbucket	atlassian bitbucket	lt	6.10.9
atlassian:bitbucket	atlassian bitbucket	lt	7.6.4
atlassian:bitbucket	atlassian bitbucket	lt	7.10.1

CNA Affected

[
  {
    "product": "Bitbucket Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "6.10.9",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.0.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.6.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.7.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.10.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Bitbucket Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "6.10.9",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.0.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.6.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.7.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.10.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

jira.atlassian.com/browse/BSERV-12753

www.kb.cert.org/vuls/id/240785

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

0.4%

JSON

Related for CVE-2020-36233

nvd1 cert1 prion1 cvelist1 atlassian2