Vulnerability-Lookup

CNVD-2020-03925

Vulnerability from cnvd - Published: 2020-02-06

Title

Bitbucket Server和Bitbucket Data Center远程代码执行漏洞

Description

Atlassian Bitbucket Server和Atlassian Bitbucket Data Center都是澳大利亚Atlassian公司的产品。Atlassian Bitbucket Server是一款Git代码托管解决方案。该方案能够管理并审查代码，具有差异视图、JIRA集成和构建集成等功能。Atlassian Bitbucket Data Center是Atlassian Bitbucket的数据中心版本。 Bitbucket Server和Bitbucket Data Center中存在远程代码执行漏洞，远程攻击者可借助带有特制内容的文件利用该漏洞在Bitbucket Server或Bitbucket Data Center系统上执行任意命令。

Severity

中

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://bitbucket.org/

Reference

https://jira.atlassian.com/browse/BSERV-12099 https://nvd.nist.gov/vuln/detail/CVE-2019-20097

Impacted products

Name
['Atlassian Bitbucket Server >=1..，<=5.16.', 'Atlassian Bitbucket Server 6.0.，<6.0.11', 'Atlassian Bitbucket Server 6.1.，<6.1.9', 'Atlassian Bitbucket Server 6.2.，<6.2.7', 'Atlassian Bitbucket Server 6.3.，<6.3.6', 'Atlassian Bitbucket Server 6.4.，<6.4.4', 'Atlassian Bitbucket Server 6.5.，<6.5.3', 'Atlassian Bitbucket Server 6.6.，<6.6.3', 'Atlassian Bitbucket Server 6.7.，<6.7.3', 'Atlassian Bitbucket Server 6.8.，<6.8.2', 'Atlassian Bitbucket Server 6.9.，<6.9.1', 'Atlassian Bitbucket Data Center >=1..，<=5.16.', 'Atlassian Bitbucket Data Center 6.0.，<6.0.11', 'Atlassian Bitbucket Data Center 6.1.，<6.1.9', 'Atlassian Bitbucket Data Center 6.2.，<6.2.7', 'Atlassian Bitbucket Data Center 6.3.，<6.3.6', 'Atlassian Bitbucket Data Center 6.4.，<6.4.4', 'Atlassian Bitbucket Data Center 6.5.，<6.5.3', 'Atlassian Bitbucket Data Center 6.6.，<6.6.3', 'Atlassian Bitbucket Data Center 6.7.，<6.7.3', 'Atlassian Bitbucket Data Center 6.8.，<6.8.2', 'Atlassian Bitbucket Data Center 6.9.，<6.9.1']

Name

['Atlassian Bitbucket Server >=1.*.*，<=5.16.*', 'Atlassian Bitbucket Server 6.0.*，<6.0.11', 'Atlassian Bitbucket Server 6.1.*，<6.1.9', 'Atlassian Bitbucket Server 6.2.*，<6.2.7', 'Atlassian Bitbucket Server 6.3.*，<6.3.6', 'Atlassian Bitbucket Server 6.4.*，<6.4.4', 'Atlassian Bitbucket Server 6.5.*，<6.5.3', 'Atlassian Bitbucket Server 6.6.*，<6.6.3', 'Atlassian Bitbucket Server 6.7.*，<6.7.3', 'Atlassian Bitbucket Server 6.8.*，<6.8.2', 'Atlassian Bitbucket Server 6.9.*，<6.9.1', 'Atlassian Bitbucket Data Center >=1.*.*，<=5.16.*', 'Atlassian Bitbucket Data Center 6.0.*，<6.0.11', 'Atlassian Bitbucket Data Center 6.1.*，<6.1.9', 'Atlassian Bitbucket Data Center 6.2.*，<6.2.7', 'Atlassian Bitbucket Data Center 6.3.*，<6.3.6', 'Atlassian Bitbucket Data Center 6.4.*，<6.4.4', 'Atlassian Bitbucket Data Center 6.5.*，<6.5.3', 'Atlassian Bitbucket Data Center 6.6.*，<6.6.3', 'Atlassian Bitbucket Data Center 6.7.*，<6.7.3', 'Atlassian Bitbucket Data Center 6.8.*，<6.8.2', 'Atlassian Bitbucket Data Center 6.9.*，<6.9.1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-20097",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20097"
    }
  },
  "description": "Atlassian Bitbucket Server\u548cAtlassian Bitbucket Data Center\u90fd\u662f\u6fb3\u5927\u5229\u4e9aAtlassian\u516c\u53f8\u7684\u4ea7\u54c1\u3002Atlassian Bitbucket Server\u662f\u4e00\u6b3eGit\u4ee3\u7801\u6258\u7ba1\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u80fd\u591f\u7ba1\u7406\u5e76\u5ba1\u67e5\u4ee3\u7801\uff0c\u5177\u6709\u5dee\u5f02\u89c6\u56fe\u3001JIRA\u96c6\u6210\u548c\u6784\u5efa\u96c6\u6210\u7b49\u529f\u80fd\u3002Atlassian Bitbucket Data Center\u662fAtlassian Bitbucket\u7684\u6570\u636e\u4e2d\u5fc3\u7248\u672c\u3002\n\nBitbucket Server\u548cBitbucket Data Center\u4e2d\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u5e26\u6709\u7279\u5236\u5185\u5bb9\u7684\u6587\u4ef6\u5229\u7528\u8be5\u6f0f\u6d1e\u5728Bitbucket Server\u6216Bitbucket Data Center\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u547d\u4ee4\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://bitbucket.org/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-03925",
  "openTime": "2020-02-06",
  "products": {
    "product": [
      "Atlassian Bitbucket Server \u003e=1.*.*\uff0c\u003c=5.16.*",
      "Atlassian Bitbucket Server 6.0.*\uff0c\u003c6.0.11",
      "Atlassian Bitbucket Server 6.1.*\uff0c\u003c6.1.9",
      "Atlassian Bitbucket Server 6.2.*\uff0c\u003c6.2.7",
      "Atlassian Bitbucket Server 6.3.*\uff0c\u003c6.3.6",
      "Atlassian Bitbucket Server 6.4.*\uff0c\u003c6.4.4",
      "Atlassian Bitbucket Server 6.5.*\uff0c\u003c6.5.3",
      "Atlassian Bitbucket Server 6.6.*\uff0c\u003c6.6.3",
      "Atlassian Bitbucket Server 6.7.*\uff0c\u003c6.7.3",
      "Atlassian Bitbucket Server 6.8.*\uff0c\u003c6.8.2",
      "Atlassian Bitbucket Server 6.9.*\uff0c\u003c6.9.1",
      "Atlassian Bitbucket Data Center \u003e=1.*.*\uff0c\u003c=5.16.*",
      "Atlassian Bitbucket Data Center 6.0.*\uff0c\u003c6.0.11",
      "Atlassian Bitbucket Data Center 6.1.*\uff0c\u003c6.1.9",
      "Atlassian Bitbucket Data Center 6.2.*\uff0c\u003c6.2.7",
      "Atlassian Bitbucket Data Center 6.3.*\uff0c\u003c6.3.6",
      "Atlassian Bitbucket Data Center 6.4.*\uff0c\u003c6.4.4",
      "Atlassian Bitbucket Data Center 6.5.*\uff0c\u003c6.5.3",
      "Atlassian Bitbucket Data Center 6.6.*\uff0c\u003c6.6.3",
      "Atlassian Bitbucket Data Center 6.7.*\uff0c\u003c6.7.3",
      "Atlassian Bitbucket Data Center 6.8.*\uff0c\u003c6.8.2",
      "Atlassian Bitbucket Data Center 6.9.*\uff0c\u003c6.9.1"
    ]
  },
  "referenceLink": "https://jira.atlassian.com/browse/BSERV-12099\r\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-20097",
  "serverity": "\u4e2d",
  "submitTime": "2020-01-15",
  "title": "Bitbucket Server\u548cBitbucket Data Center\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

CVE-2019-20097 (GCVE-0-2019-20097)

Vulnerability from cvelistv5 – Published: 2020-01-15 20:46 – Updated: 2024-09-16 18:48

Summary

Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the post-receive hook. A remote attacker with permission to clone and push files to a repository on the victim's Bitbucket Server or Bitbucket Data Center instance, can exploit this vulnerability to execute arbitrary commands on the Bitbucket Server or Bitbucket Data Center systems, using a file with specially crafted content.

Severity

No CVSS data available.

CWE

Argument Injection

Assigner

atlassian mitre root

References

1 reference

URL	Tags
https://jira.atlassian.com/browse/BSERV-12099	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
Atlassian	Bitbucket Server	Affected: 1.0 , < unspecified (custom) Affected: unspecified , < 5.16.11 (custom) Affected: 6.0 , < unspecified (custom) Affected: unspecified , < 6.0.11 (custom) Affected: 6.1.0 , < unspecified (custom) Affected: unspecified , < 6.1.9 (custom) Affected: 6.2.0 , < unspecified (custom) Affected: unspecified , < 6.2.7 (custom) Affected: 6.3.0 , < unspecified (custom) Affected: unspecified , < 6.3.6 (custom) Affected: 6.4.0 , < unspecified (custom) Affected: unspecified , < 6.4.4 (custom) Affected: 6.5.0 , < unspecified (custom) Affected: unspecified , < 6.5.3 (custom) Affected: 6.6.0 , < unspecified (custom) Affected: unspecified , < 6.6.3 (custom) Affected: 6.7.0 , < unspecified (custom) Affected: unspecified , < 6.7.3 (custom) Affected: 6.8.0 , < unspecified (custom) Affected: unspecified , < 6.8.2 (custom) Affected: 6.9.0 , < unspecified (custom) Affected: unspecified , < 6.9.1 (custom)
Atlassian	Bitbucket Data Center	Affected: 1.0 , < unspecified (custom) Affected: unspecified , < 5.16.11 (custom) Affected: 6.0 , < unspecified (custom) Affected: unspecified , < 6.0.11 (custom) Affected: 6.1.0 , < unspecified (custom) Affected: unspecified , < 6.1.9 (custom) Affected: 6.2.0 , < unspecified (custom) Affected: unspecified , < 6.2.7 (custom) Affected: 6.3.0 , < unspecified (custom) Affected: unspecified , < 6.3.6 (custom) Affected: 6.4.0 , < unspecified (custom) Affected: unspecified , < 6.4.4 (custom) Affected: 6.5.0 , < unspecified (custom) Affected: unspecified , < 6.5.3 (custom) Affected: 6.6.0 , < unspecified (custom) Affected: unspecified , < 6.6.3 (custom) Affected: 6.7.0 , < unspecified (custom) Affected: unspecified , < 6.7.3 (custom) Affected: 6.8.0 , < unspecified (custom) Affected: unspecified , < 6.8.2 (custom) Affected: 6.9.0 , < unspecified (custom) Affected: unspecified , < 6.9.1 (custom)

Date Public

2020-01-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T02:32:10.612Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/BSERV-12099"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Bitbucket Server",
          "vendor": "Atlassian",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.16.11",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.11",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.2.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.3.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.4.4",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.5.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.7.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.8.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.9.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Bitbucket Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.16.11",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.11",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.2.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.3.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.4.4",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.5.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.7.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.8.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.9.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2020-01-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the post-receive hook. A remote attacker with permission to clone and push files to a repository on the victim\u0027s Bitbucket Server or Bitbucket Data Center instance, can exploit this vulnerability to execute arbitrary commands on the Bitbucket Server or Bitbucket Data Center systems, using a file with specially crafted content."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Argument Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-15T20:46:56.000Z",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.atlassian.com/browse/BSERV-12099"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@atlassian.com",
          "DATE_PUBLIC": "2020-01-15T10:00:00",
          "ID": "CVE-2019-20097",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Bitbucket Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "1.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.16.11"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.0.11"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.1.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.1.9"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.2.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.2.7"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.3.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.3.6"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.4.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.4.4"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.5.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.5.3"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.6.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.6.3"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.7.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.7.3"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.8.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.8.2"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.9.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.9.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Bitbucket Data Center",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "1.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.16.11"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.0.11"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.1.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.1.9"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.2.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.2.7"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.3.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.3.6"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.4.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.4.4"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.5.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.5.3"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.6.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.6.3"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.7.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.7.3"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.8.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.8.2"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.9.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.9.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Atlassian"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the post-receive hook. A remote attacker with permission to clone and push files to a repository on the victim\u0027s Bitbucket Server or Bitbucket Data Center instance, can exploit this vulnerability to execute arbitrary commands on the Bitbucket Server or Bitbucket Data Center systems, using a file with specially crafted content."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Argument Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.atlassian.com/browse/BSERV-12099",
              "refsource": "MISC",
              "url": "https://jira.atlassian.com/browse/BSERV-12099"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2019-20097",
    "datePublished": "2020-01-15T20:46:56.225Z",
    "dateReserved": "2019-12-30T00:00:00.000Z",
    "dateUpdated": "2024-09-16T18:48:48.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2020-03925

CVE-2019-20097 (GCVE-0-2019-20097)

Tags

Sightings

Nomenclature

Related by attack behaviour