Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CNVD-2020-16669
Vulnerability from cnvd - Published: 2020-03-11
VLAI Severity ?
Title
Atlassian Bitbucket Server和Bitbucket Data Center远程代码执行漏洞
Description
Atlassian Bitbucket Server和Atlassian Bitbucket Data Center都是澳大利亚Atlassian公司的产品。Atlassian Bitbucket Server是一款Git代码托管解决方案。该方案能够管理并审查代码，具有差异视图、JIRA集成和构建集成等功能。Atlassian Bitbucket Data Center是Atlassian Bitbucket的数据中心版本。
Bitbucket Server和Bitbucket Data Center中存在安全漏洞。远程攻击者可借助特制的payload利用该漏洞在用户系统上执行任意命令。
Severity
中
Formal description
目前厂商暂未发布修复措施解决此安全问题，建议使用此软件的用户随时关注厂商主页或参考网址以获取解决办法： https://bitbucket.org/
Reference
https://nvd.nist.gov/vuln/detail/CVE-2019-15010
Impacted products
| Name | ['Atlassian Bitbucket >=3.x.x，<=5.16.x（5.16.11版本已修复）', 'Atlassian Bitbucket 6.0.6.0.11', 'Atlassian Bitbucket 6.1.*，<6.1.9', 'Atlassian Bitbucket 6.2.*，<6.2.7', 'Atlassian Bitbucket 6.3.*，<6.3.6', 'Atlassian Bitbucket 6.4.*，<6.4.4', 'Atlassian Bitbucket 6.5.*，<6.5.3', 'Atlassian Bitbucket 6.6.*，<6.6.3', 'Atlassian Bitbucket 6.7.*，<6.7.3', 'Atlassian Bitbucket 6.8.*，<6.8.2', 'Atlassian Bitbucket 6.9.*，<6.9.1'] |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2019-15010"
}
},
"description": "Atlassian Bitbucket Server\u548cAtlassian Bitbucket Data Center\u90fd\u662f\u6fb3\u5927\u5229\u4e9aAtlassian\u516c\u53f8\u7684\u4ea7\u54c1\u3002Atlassian Bitbucket Server\u662f\u4e00\u6b3eGit\u4ee3\u7801\u6258\u7ba1\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u80fd\u591f\u7ba1\u7406\u5e76\u5ba1\u67e5\u4ee3\u7801\uff0c\u5177\u6709\u5dee\u5f02\u89c6\u56fe\u3001JIRA\u96c6\u6210\u548c\u6784\u5efa\u96c6\u6210\u7b49\u529f\u80fd\u3002Atlassian Bitbucket Data Center\u662fAtlassian Bitbucket\u7684\u6570\u636e\u4e2d\u5fc3\u7248\u672c\u3002\n\nBitbucket Server\u548cBitbucket Data Center\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684payload\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7528\u6237\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u547d\u4ee4\u3002",
"formalWay": "\u76ee\u524d\u5382\u5546\u6682\u672a\u53d1\u5e03\u4fee\u590d\u63aa\u65bd\u89e3\u51b3\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u5efa\u8bae\u4f7f\u7528\u6b64\u8f6f\u4ef6\u7684\u7528\u6237\u968f\u65f6\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u6216\u53c2\u8003\u7f51\u5740\u4ee5\u83b7\u53d6\u89e3\u51b3\u529e\u6cd5\uff1a\r\nhttps://bitbucket.org/",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2020-16669",
"openTime": "2020-03-11",
"products": {
"product": [
"Atlassian Bitbucket \u003e=3.x.x\uff0c\u003c=5.16.x\uff085.16.11\u7248\u672c\u5df2\u4fee\u590d\uff09",
"Atlassian Bitbucket 6.0.6.0.11",
"Atlassian Bitbucket 6.1.*\uff0c\u003c6.1.9",
"Atlassian Bitbucket 6.2.*\uff0c\u003c6.2.7",
"Atlassian Bitbucket 6.3.*\uff0c\u003c6.3.6",
"Atlassian Bitbucket 6.4.*\uff0c\u003c6.4.4",
"Atlassian Bitbucket 6.5.*\uff0c\u003c6.5.3",
"Atlassian Bitbucket 6.6.*\uff0c\u003c6.6.3",
"Atlassian Bitbucket 6.7.*\uff0c\u003c6.7.3",
"Atlassian Bitbucket 6.8.*\uff0c\u003c6.8.2",
"Atlassian Bitbucket 6.9.*\uff0c\u003c6.9.1"
]
},
"referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-15010",
"serverity": "\u4e2d",
"submitTime": "2020-01-22",
"title": "Atlassian Bitbucket Server\u548cBitbucket Data Center\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}
CVE-2019-15010 (GCVE-0-2019-15010)
Vulnerability from cvelistv5 – Published: 2020-01-15 20:46 – Updated: 2024-09-16 22:56
VLAI?
EPSS
Summary
Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, and from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via certain user input fields. A remote attacker with user level permissions can exploit this vulnerability to run arbitrary commands on the victim's systems. Using a specially crafted payload as user input, the attacker can execute arbitrary commands on the victim's Bitbucket Server or Bitbucket Data Center instance.
Severity ?
No CVSS data available.
CWE
- Expression Language Injection
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Atlassian | Bitbucket Server |
Affected:
3.0 , < unspecified
(custom)
Affected: unspecified , < 5.16.11 (custom) Affected: 6.0 , < unspecified (custom) Affected: unspecified , < 6.0.11 (custom) Affected: 6.1.0 , < unspecified (custom) Affected: unspecified , < 6.1.9 (custom) Affected: 6.2.0 , < unspecified (custom) Affected: unspecified , < 6.2.7 (custom) Affected: 6.3.0 , < unspecified (custom) Affected: unspecified , < 6.3.6 (custom) Affected: 6.4.0 , < unspecified (custom) Affected: unspecified , < 6.4.4 (custom) Affected: 6.5.0 , < unspecified (custom) Affected: unspecified , < 6.5.3 (custom) Affected: 6.6.0 , < unspecified (custom) Affected: unspecified , < 6.6.3 (custom) Affected: 6.7.0 , < unspecified (custom) Affected: unspecified , < 6.7.3 (custom) Affected: 6.8.0 , < unspecified (custom) Affected: unspecified , < 6.8.2 (custom) Affected: 6.9.0 , < unspecified (custom) Affected: unspecified , < 6.9.1 (custom) |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T00:34:53.027Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jira.atlassian.com/browse/BSERV-12098"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Bitbucket Server",
"vendor": "Atlassian",
"versions": [
{
"lessThan": "unspecified",
"status": "affected",
"version": "3.0",
"versionType": "custom"
},
{
"lessThan": "5.16.11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.0",
"versionType": "custom"
},
{
"lessThan": "6.0.11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "6.1.9",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"lessThan": "6.2.7",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"lessThan": "6.3.6",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
},
{
"lessThan": "6.4.4",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.5.0",
"versionType": "custom"
},
{
"lessThan": "6.5.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
},
{
"lessThan": "6.6.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.7.0",
"versionType": "custom"
},
{
"lessThan": "6.7.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.8.0",
"versionType": "custom"
},
{
"lessThan": "6.8.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.9.0",
"versionType": "custom"
},
{
"lessThan": "6.9.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Bitbucket Data Center",
"vendor": "Atlassian",
"versions": [
{
"lessThan": "unspecified",
"status": "affected",
"version": "3.0",
"versionType": "custom"
},
{
"lessThan": "5.16.11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.0",
"versionType": "custom"
},
{
"lessThan": "6.0.11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "6.1.9",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"lessThan": "6.2.7",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"lessThan": "6.3.6",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
},
{
"lessThan": "6.4.4",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.5.0",
"versionType": "custom"
},
{
"lessThan": "6.5.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
},
{
"lessThan": "6.6.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.7.0",
"versionType": "custom"
},
{
"lessThan": "6.7.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.8.0",
"versionType": "custom"
},
{
"lessThan": "6.8.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "6.9.0",
"versionType": "custom"
},
{
"lessThan": "6.9.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2020-01-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, and from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via certain user input fields. A remote attacker with user level permissions can exploit this vulnerability to run arbitrary commands on the victim\u0027s systems. Using a specially crafted payload as user input, the attacker can execute arbitrary commands on the victim\u0027s Bitbucket Server or Bitbucket Data Center instance."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Expression Language Injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-15T20:46:56",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.atlassian.com/browse/BSERV-12098"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@atlassian.com",
"DATE_PUBLIC": "2020-01-15T10:00:00",
"ID": "CVE-2019-15010",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Bitbucket Server",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_value": "3.0"
},
{
"version_affected": "\u003c",
"version_value": "5.16.11"
},
{
"version_affected": "\u003e=",
"version_value": "6.0"
},
{
"version_affected": "\u003c",
"version_value": "6.0.11"
},
{
"version_affected": "\u003e=",
"version_value": "6.1.0"
},
{
"version_affected": "\u003c",
"version_value": "6.1.9"
},
{
"version_affected": "\u003e=",
"version_value": "6.2.0"
},
{
"version_affected": "\u003c",
"version_value": "6.2.7"
},
{
"version_affected": "\u003e=",
"version_value": "6.3.0"
},
{
"version_affected": "\u003c",
"version_value": "6.3.6"
},
{
"version_affected": "\u003e=",
"version_value": "6.4.0"
},
{
"version_affected": "\u003c",
"version_value": "6.4.4"
},
{
"version_affected": "\u003e=",
"version_value": "6.5.0"
},
{
"version_affected": "\u003c",
"version_value": "6.5.3"
},
{
"version_affected": "\u003e=",
"version_value": "6.6.0"
},
{
"version_affected": "\u003c",
"version_value": "6.6.3"
},
{
"version_affected": "\u003e=",
"version_value": "6.7.0"
},
{
"version_affected": "\u003c",
"version_value": "6.7.3"
},
{
"version_affected": "\u003e=",
"version_value": "6.8.0"
},
{
"version_affected": "\u003c",
"version_value": "6.8.2"
},
{
"version_affected": "\u003e=",
"version_value": "6.9.0"
},
{
"version_affected": "\u003c",
"version_value": "6.9.1"
}
]
}
},
{
"product_name": "Bitbucket Data Center",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_value": "3.0"
},
{
"version_affected": "\u003c",
"version_value": "5.16.11"
},
{
"version_affected": "\u003e=",
"version_value": "6.0"
},
{
"version_affected": "\u003c",
"version_value": "6.0.11"
},
{
"version_affected": "\u003e=",
"version_value": "6.1.0"
},
{
"version_affected": "\u003c",
"version_value": "6.1.9"
},
{
"version_affected": "\u003e=",
"version_value": "6.2.0"
},
{
"version_affected": "\u003c",
"version_value": "6.2.7"
},
{
"version_affected": "\u003e=",
"version_value": "6.3.0"
},
{
"version_affected": "\u003c",
"version_value": "6.3.6"
},
{
"version_affected": "\u003e=",
"version_value": "6.4.0"
},
{
"version_affected": "\u003c",
"version_value": "6.4.4"
},
{
"version_affected": "\u003e=",
"version_value": "6.5.0"
},
{
"version_affected": "\u003c",
"version_value": "6.5.3"
},
{
"version_affected": "\u003e=",
"version_value": "6.6.0"
},
{
"version_affected": "\u003c",
"version_value": "6.6.3"
},
{
"version_affected": "\u003e=",
"version_value": "6.7.0"
},
{
"version_affected": "\u003c",
"version_value": "6.7.3"
},
{
"version_affected": "\u003e=",
"version_value": "6.8.0"
},
{
"version_affected": "\u003c",
"version_value": "6.8.2"
},
{
"version_affected": "\u003e=",
"version_value": "6.9.0"
},
{
"version_affected": "\u003c",
"version_value": "6.9.1"
}
]
}
}
]
},
"vendor_name": "Atlassian"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, and from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via certain user input fields. A remote attacker with user level permissions can exploit this vulnerability to run arbitrary commands on the victim\u0027s systems. Using a specially crafted payload as user input, the attacker can execute arbitrary commands on the victim\u0027s Bitbucket Server or Bitbucket Data Center instance."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Expression Language Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jira.atlassian.com/browse/BSERV-12098",
"refsource": "MISC",
"url": "https://jira.atlassian.com/browse/BSERV-12098"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2019-15010",
"datePublished": "2020-01-15T20:46:56.108707Z",
"dateReserved": "2019-08-13T00:00:00",
"dateUpdated": "2024-09-16T22:56:09.402Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…