cvelistv5 - CVE-2019-15012

CVE-2019-15012 (GCVE-0-2019-15012)

Vulnerability from cvelistv5 – Published: 2020-01-15 20:46 – Updated: 2024-09-17 04:24

Summary

Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint, if the user has Bitbucket Server or Bitbucket Data Center running, and has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance.

Severity ?

No CVSS data available.

CWE

Path traversal

Assigner

atlassian

References

URL

Tags

https://jira.atlassian.com/browse/BSERV-12100

x_refsource_MISC

Impacted products

Vendor

Product

Version

Atlassian

Bitbucket Server

Affected: 4.13 , < unspecified (custom)
Affected: unspecified , < 5.16.11 (custom)
Affected: 6.0 , < unspecified (custom)
Affected: unspecified , < 6.0.11 (custom)
Affected: 6.1.0 , < unspecified (custom)
Affected: unspecified , < 6.1.9 (custom)
Affected: 6.2.0 , < unspecified (custom)
Affected: unspecified , < 6.2.7 (custom)
Affected: 6.3.0 , < unspecified (custom)
Affected: unspecified , < 6.3.6 (custom)
Affected: 6.4.0 , < unspecified (custom)
Affected: unspecified , < 6.4.4 (custom)
Affected: 6.5.0 , < unspecified (custom)
Affected: unspecified , < 6.5.3 (custom)
Affected: 6.6.0 , < unspecified (custom)
Affected: unspecified , < 6.6.3 (custom)
Affected: 6.7.0 , < unspecified (custom)
Affected: unspecified , < 6.7.3 (custom)
Affected: 6.8.0 , < unspecified (custom)
Affected: unspecified , < 6.8.2 (custom)
Affected: 6.9.0 , < unspecified (custom)
Affected: unspecified , < 6.9.1 (custom)

Atlassian

Bitbucket Data Center

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:34:53.124Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/BSERV-12100"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Bitbucket Server",
          "vendor": "Atlassian",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "4.13",
              "versionType": "custom"
            },
            {
              "lessThan": "5.16.11",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.11",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.2.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.3.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.4.4",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.5.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.7.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.8.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.9.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Bitbucket Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "4.13",
              "versionType": "custom"
            },
            {
              "lessThan": "5.16.11",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.11",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.2.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.3.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.4.4",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.5.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.7.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.8.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.9.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2020-01-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint, if the user has Bitbucket Server or Bitbucket Data Center running, and has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Path traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-15T20:46:56",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.atlassian.com/browse/BSERV-12100"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@atlassian.com",
          "DATE_PUBLIC": "2020-01-15T10:00:00",
          "ID": "CVE-2019-15012",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Bitbucket Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "4.13"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.16.11"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.0.11"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.1.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.1.9"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.2.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.2.7"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.3.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.3.6"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.4.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.4.4"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.5.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.5.3"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.6.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.6.3"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.7.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.7.3"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.8.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.8.2"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.9.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.9.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Bitbucket Data Center",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "4.13"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.16.11"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.0.11"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.1.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.1.9"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.2.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.2.7"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.3.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.3.6"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.4.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.4.4"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.5.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.5.3"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.6.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.6.3"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.7.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.7.3"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.8.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.8.2"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.9.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.9.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Atlassian"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint, if the user has Bitbucket Server or Bitbucket Data Center running, and has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Path traversal"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.atlassian.com/browse/BSERV-12100",
              "refsource": "MISC",
              "url": "https://jira.atlassian.com/browse/BSERV-12100"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2019-15012",
    "datePublished": "2020-01-15T20:46:56.181070Z",
    "dateReserved": "2019-08-13T00:00:00",
    "dateUpdated": "2024-09-17T04:24:12.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.13.0\", \"versionEndExcluding\": \"5.6.11\", \"matchCriteriaId\": \"77D2D5CB-064D-44C7-9C80-46BDD4A833B3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.0.0\", \"versionEndExcluding\": \"6.0.11\", \"matchCriteriaId\": \"48C8C6EE-1C20-4A8D-BEDA-166FBBEFCF2F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.1.0\", \"versionEndExcluding\": \"6.1.9\", \"matchCriteriaId\": \"FFF37587-82F5-4EE0-A937-28C38801D764\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2.0\", \"versionEndExcluding\": \"6.2.7\", \"matchCriteriaId\": \"42E0BC42-C30E-4A8E-A8EE-FBDE1DE54320\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.3.0\", \"versionEndExcluding\": \"6.3.6\", \"matchCriteriaId\": \"B9684FBA-86AA-41DC-BE24-E569528D73F5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.4.0\", \"versionEndExcluding\": \"6.4.4\", \"matchCriteriaId\": \"D9DB2AEC-BCD8-4F4C-8B46-DA7C1106CC19\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.5.0\", \"versionEndExcluding\": \"6.5.3\", \"matchCriteriaId\": \"5EFDFE4F-C06F-4E7D-B4FB-9AF75ADF9B0D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.6.0\", \"versionEndExcluding\": \"6.6.3\", \"matchCriteriaId\": \"24C8E399-F9B1-4C2F-8950-743D5648FCB8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7.0\", \"versionEndExcluding\": \"6.7.3\", \"matchCriteriaId\": \"EF8E5098-21B9-416A-A83B-9F9141DEEC7C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.8.0\", \"versionEndExcluding\": \"6.8.2\", \"matchCriteriaId\": \"866E87CD-8AD5-4241-82F9-80720F1E794E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.9.0\", \"versionEndExcluding\": \"6.9.1\", \"matchCriteriaId\": \"2873B168-8A85-4AB0-BD92-95423928F20D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint, if the user has Bitbucket Server or Bitbucket Data Center running, and has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance.\"}, {\"lang\": \"es\", \"value\": \"Bitbucket Server y Bitbucket Data Center desde la versi\\u00f3n 4.13. anteriores a la versi\\u00f3n 5.16.11, desde versi\\u00f3n 6.0.0 anteriores a la versi\\u00f3n  6.0.11, desde versi\\u00f3n 6.1.0 anteriores a la versi\\u00f3n  6.1.9, desde versi\\u00f3n 6.2.0 anteriores a la versi\\u00f3n  6.2.7, desde versi\\u00f3n 6.3.0 anteriores a la versi\\u00f3n  6.3.6, desde versi\\u00f3n 6.4.0 anteriores a la versi\\u00f3n  6.4.4, desde versi\\u00f3n 6.5.0 anteriores a  la versi\\u00f3n 6.5.3, desde versi\\u00f3n 6.6.0 anteriores a 6.6.3, desde versi\\u00f3n 6.7.0 anteriores a 6.7.3, desde versi\\u00f3n 6.8.0 anteriores a la versi\\u00f3n  6.8.2, desde versi\\u00f3n 6.9.0 anteriores a la versi\\u00f3n  6.9.1, tiene una vulnerabilidad de Ejecuci\\u00f3n de C\\u00f3digo Remota por medio de la petici\\u00f3n edit-file. Un atacante remoto con permiso de escritura en un repositorio puede escribir en cualquier archivo arbitrario en las instancias de Bitbucket Server o Bitbucket Data Center de las v\\u00edctimas utilizando el endpoint edit-file, si el usuario tiene Bitbucket Server o Bitbucket Data Center en ejecuci\\u00f3n, y posee permiso para escribir el archivo en ese destino. En algunos casos, esto puede resultar en la ejecuci\\u00f3n de c\\u00f3digo arbitrario para las instancias Bitbucket Server o Bitbucket Data Center de las v\\u00edctimas.\"}]",
      "id": "CVE-2019-15012",
      "lastModified": "2024-11-21T04:27:52.303",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:P/A:P\", \"baseScore\": 6.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2020-01-15T21:15:12.390",
      "references": "[{\"url\": \"https://jira.atlassian.com/browse/BSERV-12100\", \"source\": \"security@atlassian.com\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://jira.atlassian.com/browse/BSERV-12100\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "security@atlassian.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-269\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-15012\",\"sourceIdentifier\":\"security@atlassian.com\",\"published\":\"2020-01-15T21:15:12.390\",\"lastModified\":\"2024-11-21T04:27:52.303\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint, if the user has Bitbucket Server or Bitbucket Data Center running, and has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance.\"},{\"lang\":\"es\",\"value\":\"Bitbucket Server y Bitbucket Data Center desde la versi\u00f3n 4.13. anteriores a la versi\u00f3n 5.16.11, desde versi\u00f3n 6.0.0 anteriores a la versi\u00f3n  6.0.11, desde versi\u00f3n 6.1.0 anteriores a la versi\u00f3n  6.1.9, desde versi\u00f3n 6.2.0 anteriores a la versi\u00f3n  6.2.7, desde versi\u00f3n 6.3.0 anteriores a la versi\u00f3n  6.3.6, desde versi\u00f3n 6.4.0 anteriores a la versi\u00f3n  6.4.4, desde versi\u00f3n 6.5.0 anteriores a  la versi\u00f3n 6.5.3, desde versi\u00f3n 6.6.0 anteriores a 6.6.3, desde versi\u00f3n 6.7.0 anteriores a 6.7.3, desde versi\u00f3n 6.8.0 anteriores a la versi\u00f3n  6.8.2, desde versi\u00f3n 6.9.0 anteriores a la versi\u00f3n  6.9.1, tiene una vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota por medio de la petici\u00f3n edit-file. Un atacante remoto con permiso de escritura en un repositorio puede escribir en cualquier archivo arbitrario en las instancias de Bitbucket Server o Bitbucket Data Center de las v\u00edctimas utilizando el endpoint edit-file, si el usuario tiene Bitbucket Server o Bitbucket Data Center en ejecuci\u00f3n, y posee permiso para escribir el archivo en ese destino. En algunos casos, esto puede resultar en la ejecuci\u00f3n de c\u00f3digo arbitrario para las instancias Bitbucket Server o Bitbucket Data Center de las v\u00edctimas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:P\",\"baseScore\":6.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-269\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.13.0\",\"versionEndExcluding\":\"5.6.11\",\"matchCriteriaId\":\"77D2D5CB-064D-44C7-9C80-46BDD4A833B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.0.11\",\"matchCriteriaId\":\"48C8C6EE-1C20-4A8D-BEDA-166FBBEFCF2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.0\",\"versionEndExcluding\":\"6.1.9\",\"matchCriteriaId\":\"FFF37587-82F5-4EE0-A937-28C38801D764\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2.0\",\"versionEndExcluding\":\"6.2.7\",\"matchCriteriaId\":\"42E0BC42-C30E-4A8E-A8EE-FBDE1DE54320\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3.0\",\"versionEndExcluding\":\"6.3.6\",\"matchCriteriaId\":\"B9684FBA-86AA-41DC-BE24-E569528D73F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4.0\",\"versionEndExcluding\":\"6.4.4\",\"matchCriteriaId\":\"D9DB2AEC-BCD8-4F4C-8B46-DA7C1106CC19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5.0\",\"versionEndExcluding\":\"6.5.3\",\"matchCriteriaId\":\"5EFDFE4F-C06F-4E7D-B4FB-9AF75ADF9B0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.0\",\"versionEndExcluding\":\"6.6.3\",\"matchCriteriaId\":\"24C8E399-F9B1-4C2F-8950-743D5648FCB8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7.0\",\"versionEndExcluding\":\"6.7.3\",\"matchCriteriaId\":\"EF8E5098-21B9-416A-A83B-9F9141DEEC7C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8.0\",\"versionEndExcluding\":\"6.8.2\",\"matchCriteriaId\":\"866E87CD-8AD5-4241-82F9-80720F1E794E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9.0\",\"versionEndExcluding\":\"6.9.1\",\"matchCriteriaId\":\"2873B168-8A85-4AB0-BD92-95423928F20D\"}]}]}],\"references\":[{\"url\":\"https://jira.atlassian.com/browse/BSERV-12100\",\"source\":\"security@atlassian.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/BSERV-12100\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]}]}}"
  }
}

GSD-2019-15012

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2019-15012

Aliases

CVE-2019-15012

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2019-15012",
    "description": "Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint, if the user has Bitbucket Server or Bitbucket Data Center running, and has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance.",
    "id": "GSD-2019-15012"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2019-15012"
      ],
      "details": "Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint, if the user has Bitbucket Server or Bitbucket Data Center running, and has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance.",
      "id": "GSD-2019-15012",
      "modified": "2023-12-13T01:23:38.099382Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@atlassian.com",
        "DATE_PUBLIC": "2020-01-15T10:00:00",
        "ID": "CVE-2019-15012",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Bitbucket Server",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003e=",
                          "version_value": "4.13"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "5.16.11"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.0.11"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.1.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.1.9"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.2.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.2.7"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.3.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.3.6"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.4.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.4.4"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.5.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.5.3"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.6.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.6.3"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.7.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.7.3"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.8.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.8.2"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.9.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.9.1"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Bitbucket Data Center",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003e=",
                          "version_value": "4.13"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "5.16.11"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.0.11"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.1.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.1.9"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.2.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.2.7"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.3.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.3.6"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.4.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.4.4"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.5.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.5.3"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.6.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.6.3"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.7.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.7.3"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.8.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.8.2"
                        },
                        {
                          "version_affected": "\u003e=",
                          "version_value": "6.9.0"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_value": "6.9.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Atlassian"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint, if the user has Bitbucket Server or Bitbucket Data Center running, and has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Path traversal"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://jira.atlassian.com/browse/BSERV-12100",
            "refsource": "MISC",
            "url": "https://jira.atlassian.com/browse/BSERV-12100"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.6.11",
                "versionStartIncluding": "4.13.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.0.11",
                "versionStartIncluding": "6.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.1.9",
                "versionStartIncluding": "6.1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.2.7",
                "versionStartIncluding": "6.2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.3.6",
                "versionStartIncluding": "6.3.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.4.4",
                "versionStartIncluding": "6.4.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.5.3",
                "versionStartIncluding": "6.5.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.6.3",
                "versionStartIncluding": "6.6.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.7.3",
                "versionStartIncluding": "6.7.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.8.2",
                "versionStartIncluding": "6.8.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.9.1",
                "versionStartIncluding": "6.9.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@atlassian.com",
          "ID": "CVE-2019-15012"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint, if the user has Bitbucket Server or Bitbucket Data Center running, and has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-269"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.atlassian.com/browse/BSERV-12100",
              "refsource": "MISC",
              "tags": [
                "Issue Tracking",
                "Vendor Advisory"
              ],
              "url": "https://jira.atlassian.com/browse/BSERV-12100"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2020-08-24T17:37Z",
      "publishedDate": "2020-01-15T21:15Z"
    }
  }
}

GHSA-4HFV-698V-C974

Vulnerability from github – Published: 2022-05-24 17:06 – Updated: 2022-05-24 17:06

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-15012"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-01-15T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint, if the user has Bitbucket Server or Bitbucket Data Center running, and has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance.",
  "id": "GHSA-4hfv-698v-c974",
  "modified": "2022-05-24T17:06:14Z",
  "published": "2022-05-24T17:06:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15012"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/BSERV-12100"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

FKIE_CVE-2019-15012

Vulnerability from fkie_nvd - Published: 2020-01-15 21:15 - Updated: 2024-11-21 04:27

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security@atlassian.com	https://jira.atlassian.com/browse/BSERV-12100	Issue Tracking, Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://jira.atlassian.com/browse/BSERV-12100	Issue Tracking, Vendor Advisory

Impacted products

Vendor	Product	Version
atlassian	bitbucket	*
atlassian	bitbucket	*
atlassian	bitbucket	*
atlassian	bitbucket	*
atlassian	bitbucket	*
atlassian	bitbucket	*
atlassian	bitbucket	*
atlassian	bitbucket	*
atlassian	bitbucket	*
atlassian	bitbucket	*
atlassian	bitbucket	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "77D2D5CB-064D-44C7-9C80-46BDD4A833B3",
              "versionEndExcluding": "5.6.11",
              "versionStartIncluding": "4.13.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "48C8C6EE-1C20-4A8D-BEDA-166FBBEFCF2F",
              "versionEndExcluding": "6.0.11",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFF37587-82F5-4EE0-A937-28C38801D764",
              "versionEndExcluding": "6.1.9",
              "versionStartIncluding": "6.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "42E0BC42-C30E-4A8E-A8EE-FBDE1DE54320",
              "versionEndExcluding": "6.2.7",
              "versionStartIncluding": "6.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B9684FBA-86AA-41DC-BE24-E569528D73F5",
              "versionEndExcluding": "6.3.6",
              "versionStartIncluding": "6.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9DB2AEC-BCD8-4F4C-8B46-DA7C1106CC19",
              "versionEndExcluding": "6.4.4",
              "versionStartIncluding": "6.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5EFDFE4F-C06F-4E7D-B4FB-9AF75ADF9B0D",
              "versionEndExcluding": "6.5.3",
              "versionStartIncluding": "6.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "24C8E399-F9B1-4C2F-8950-743D5648FCB8",
              "versionEndExcluding": "6.6.3",
              "versionStartIncluding": "6.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF8E5098-21B9-416A-A83B-9F9141DEEC7C",
              "versionEndExcluding": "6.7.3",
              "versionStartIncluding": "6.7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "866E87CD-8AD5-4241-82F9-80720F1E794E",
              "versionEndExcluding": "6.8.2",
              "versionStartIncluding": "6.8.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2873B168-8A85-4AB0-BD92-95423928F20D",
              "versionEndExcluding": "6.9.1",
              "versionStartIncluding": "6.9.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint, if the user has Bitbucket Server or Bitbucket Data Center running, and has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance."
    },
    {
      "lang": "es",
      "value": "Bitbucket Server y Bitbucket Data Center desde la versi\u00f3n 4.13. anteriores a la versi\u00f3n 5.16.11, desde versi\u00f3n 6.0.0 anteriores a la versi\u00f3n  6.0.11, desde versi\u00f3n 6.1.0 anteriores a la versi\u00f3n  6.1.9, desde versi\u00f3n 6.2.0 anteriores a la versi\u00f3n  6.2.7, desde versi\u00f3n 6.3.0 anteriores a la versi\u00f3n  6.3.6, desde versi\u00f3n 6.4.0 anteriores a la versi\u00f3n  6.4.4, desde versi\u00f3n 6.5.0 anteriores a  la versi\u00f3n 6.5.3, desde versi\u00f3n 6.6.0 anteriores a 6.6.3, desde versi\u00f3n 6.7.0 anteriores a 6.7.3, desde versi\u00f3n 6.8.0 anteriores a la versi\u00f3n  6.8.2, desde versi\u00f3n 6.9.0 anteriores a la versi\u00f3n  6.9.1, tiene una vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota por medio de la petici\u00f3n edit-file. Un atacante remoto con permiso de escritura en un repositorio puede escribir en cualquier archivo arbitrario en las instancias de Bitbucket Server o Bitbucket Data Center de las v\u00edctimas utilizando el endpoint edit-file, si el usuario tiene Bitbucket Server o Bitbucket Data Center en ejecuci\u00f3n, y posee permiso para escribir el archivo en ese destino. En algunos casos, esto puede resultar en la ejecuci\u00f3n de c\u00f3digo arbitrario para las instancias Bitbucket Server o Bitbucket Data Center de las v\u00edctimas."
    }
  ],
  "id": "CVE-2019-15012",
  "lastModified": "2024-11-21T04:27:52.303",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-01-15T21:15:12.390",
  "references": [
    {
      "source": "security@atlassian.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/BSERV-12100"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/BSERV-12100"
    }
  ],
  "sourceIdentifier": "security@atlassian.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CNVD-2020-03926

Vulnerability from cnvd - Published: 2020-02-06

Title

Bitbucket Server和Bitbucket Data Center远程代码执行漏洞（CNVD-2020-03926）

Description

Atlassian Bitbucket Server和Atlassian Bitbucket Data Center都是澳大利亚Atlassian公司的产品。Atlassian Bitbucket Server是一款Git代码托管解决方案。该方案能够管理并审查代码，具有差异视图、JIRA集成和构建集成等功能。Atlassian Bitbucket Data Center是Atlassian Bitbucket的数据中心版本。 Bitbucket Server和Bitbucket Data Center中存在远程代码执行漏洞，攻击者可利用该漏洞编写任意文件并可能执行任意代码。

Severity

中

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://bitbucket.org/

Reference

https://jira.atlassian.com/browse/BSERV-12100 https://nvd.nist.gov/vuln/detail/CVE-2019-15012

Impacted products

Name
['Atlassian Bitbucket Server 6.0.，<6.0.11', 'Atlassian Bitbucket Server 6.1.，<6.1.9', 'Atlassian Bitbucket Server 6.2.，<6.2.7', 'Atlassian Bitbucket Server 6.3.，<6.3.6', 'Atlassian Bitbucket Server 6.4.，<6.4.4', 'Atlassian Bitbucket Server 6.5.，<6.5.3', 'Atlassian Bitbucket Server 6.6.，<6.6.3', 'Atlassian Bitbucket Server 6.7.，<6.7.3', 'Atlassian Bitbucket Server 6.8.，<6.8.2', 'Atlassian Bitbucket Server 6.9.，<6.9.1', 'Atlassian Bitbucket Data Center 6.0.，<6.0.11', 'Atlassian Bitbucket Data Center 6.1.，<6.1.9', 'Atlassian Bitbucket Data Center 6.2.，<6.2.7', 'Atlassian Bitbucket Data Center 6.3.，<6.3.6', 'Atlassian Bitbucket Data Center 6.4.，<6.4.4', 'Atlassian Bitbucket Data Center 6.5.，<6.5.3', 'Atlassian Bitbucket Data Center 6.6.，<6.6.3', 'Atlassian Bitbucket Data Center 6.7.，<6.7.3', 'Atlassian Bitbucket Data Center 6.8.，<6.8.2', 'Atlassian Bitbucket Data Center 6.9.，<6.9.1', 'Atlassian Bitbucket Server >=4.13.，<=5.16.', 'Atlassian Bitbucket Data Center >=4.13.，<=5.16.']

Name

['Atlassian Bitbucket Server 6.0.*，<6.0.11', 'Atlassian Bitbucket Server 6.1.*，<6.1.9', 'Atlassian Bitbucket Server 6.2.*，<6.2.7', 'Atlassian Bitbucket Server 6.3.*，<6.3.6', 'Atlassian Bitbucket Server 6.4.*，<6.4.4', 'Atlassian Bitbucket Server 6.5.*，<6.5.3', 'Atlassian Bitbucket Server 6.6.*，<6.6.3', 'Atlassian Bitbucket Server 6.7.*，<6.7.3', 'Atlassian Bitbucket Server 6.8.*，<6.8.2', 'Atlassian Bitbucket Server 6.9.*，<6.9.1', 'Atlassian Bitbucket Data Center 6.0.*，<6.0.11', 'Atlassian Bitbucket Data Center 6.1.*，<6.1.9', 'Atlassian Bitbucket Data Center 6.2.*，<6.2.7', 'Atlassian Bitbucket Data Center 6.3.*，<6.3.6', 'Atlassian Bitbucket Data Center 6.4.*，<6.4.4', 'Atlassian Bitbucket Data Center 6.5.*，<6.5.3', 'Atlassian Bitbucket Data Center 6.6.*，<6.6.3', 'Atlassian Bitbucket Data Center 6.7.*，<6.7.3', 'Atlassian Bitbucket Data Center 6.8.*，<6.8.2', 'Atlassian Bitbucket Data Center 6.9.*，<6.9.1', 'Atlassian Bitbucket Server >=4.13.*，<=5.16.*', 'Atlassian Bitbucket Data Center >=4.13.*，<=5.16.*']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-15012"
    }
  },
  "description": "Atlassian Bitbucket Server\u548cAtlassian Bitbucket Data Center\u90fd\u662f\u6fb3\u5927\u5229\u4e9aAtlassian\u516c\u53f8\u7684\u4ea7\u54c1\u3002Atlassian Bitbucket Server\u662f\u4e00\u6b3eGit\u4ee3\u7801\u6258\u7ba1\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u80fd\u591f\u7ba1\u7406\u5e76\u5ba1\u67e5\u4ee3\u7801\uff0c\u5177\u6709\u5dee\u5f02\u89c6\u56fe\u3001JIRA\u96c6\u6210\u548c\u6784\u5efa\u96c6\u6210\u7b49\u529f\u80fd\u3002Atlassian Bitbucket Data Center\u662fAtlassian Bitbucket\u7684\u6570\u636e\u4e2d\u5fc3\u7248\u672c\u3002\n\nBitbucket Server\u548cBitbucket Data Center\u4e2d\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7f16\u5199\u4efb\u610f\u6587\u4ef6\u5e76\u53ef\u80fd\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://bitbucket.org/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-03926",
  "openTime": "2020-02-06",
  "products": {
    "product": [
      "Atlassian Bitbucket Server 6.0.*\uff0c\u003c6.0.11",
      "Atlassian Bitbucket Server 6.1.*\uff0c\u003c6.1.9",
      "Atlassian Bitbucket Server 6.2.*\uff0c\u003c6.2.7",
      "Atlassian Bitbucket Server 6.3.*\uff0c\u003c6.3.6",
      "Atlassian Bitbucket Server 6.4.*\uff0c\u003c6.4.4",
      "Atlassian Bitbucket Server 6.5.*\uff0c\u003c6.5.3",
      "Atlassian Bitbucket Server 6.6.*\uff0c\u003c6.6.3",
      "Atlassian Bitbucket Server 6.7.*\uff0c\u003c6.7.3",
      "Atlassian Bitbucket Server 6.8.*\uff0c\u003c6.8.2",
      "Atlassian Bitbucket Server 6.9.*\uff0c\u003c6.9.1",
      "Atlassian Bitbucket Data Center 6.0.*\uff0c\u003c6.0.11",
      "Atlassian Bitbucket Data Center 6.1.*\uff0c\u003c6.1.9",
      "Atlassian Bitbucket Data Center 6.2.*\uff0c\u003c6.2.7",
      "Atlassian Bitbucket Data Center 6.3.*\uff0c\u003c6.3.6",
      "Atlassian Bitbucket Data Center 6.4.*\uff0c\u003c6.4.4",
      "Atlassian Bitbucket Data Center 6.5.*\uff0c\u003c6.5.3",
      "Atlassian Bitbucket Data Center 6.6.*\uff0c\u003c6.6.3",
      "Atlassian Bitbucket Data Center 6.7.*\uff0c\u003c6.7.3",
      "Atlassian Bitbucket Data Center 6.8.*\uff0c\u003c6.8.2",
      "Atlassian Bitbucket Data Center 6.9.*\uff0c\u003c6.9.1",
      "Atlassian Bitbucket Server \u003e=4.13.*\uff0c\u003c=5.16.*",
      "Atlassian Bitbucket Data Center \u003e=4.13.*\uff0c\u003c=5.16.*"
    ]
  },
  "referenceLink": "https://jira.atlassian.com/browse/BSERV-12100\r\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-15012",
  "serverity": "\u4e2d",
  "submitTime": "2020-01-15",
  "title": "Bitbucket Server\u548cBitbucket Data Center\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2020-03926\uff09"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2019-15012 (GCVE-0-2019-15012)

GSD-2019-15012

GHSA-4HFV-698V-C974

FKIE_CVE-2019-15012

CNVD-2020-03926

Tags

Sightings

Nomenclature