cve-2017-18087
Vulnerability from cvelistv5
Published
2018-02-15 13:00
Modified
2024-09-17 01:56
Severity
Summary
The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version 5.4.0 before version 5.4.1 allows remote attackers to write files to disk potentially allowing them to gain code execution, exploit CVE-2017-1000117 if a vulnerable version of git is in use, and or determine if an internal service exists via an argument injection vulnerability in the at parameter.
References
| Source | URL | Tags |
|---|---|---|
| security@atlassian.com | http://www.securityfocus.com/bid/103038 | Third Party Advisory, VDB Entry |
| security@atlassian.com | https://jira.atlassian.com/browse/BSERV-10593 | Vendor Advisory |
Impacted products
| Vendor | Product |
|---|---|
| Atlassian | Bitbucket Server |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:13:48.134Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "103038",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/103038"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://jira.atlassian.com/browse/BSERV-10593"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Bitbucket Server",
"vendor": "Atlassian",
"versions": [
{
"status": "affected",
"version": "from 5.1.0 prior to 5.1.7"
},
{
"status": "affected",
"version": "from 5.2.0 prior to 5.2.5"
},
{
"status": "affected",
"version": "from 5.3.0 prior to 5.3.3"
},
{
"status": "affected",
"version": "from 5.4.0 prior to 5.4.1"
}
]
}
],
"datePublic": "2018-02-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version 5.4.0 before version 5.4.1 allows remote attackers to write files to disk potentially allowing them to gain code execution, exploit CVE-2017-1000117 if a vulnerable version of git is in use, and or determine if an internal service exists via an argument injection vulnerability in the at parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Argument Injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-02-16T10:57:01",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"name": "103038",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/103038"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://jira.atlassian.com/browse/BSERV-10593"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@atlassian.com",
"DATE_PUBLIC": "2018-02-15T00:00:00",
"ID": "CVE-2017-18087",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Bitbucket Server",
"version": {
"version_data": [
{
"version_value": "from 5.1.0 prior to 5.1.7"
},
{
"version_value": "from 5.2.0 prior to 5.2.5"
},
{
"version_value": "from 5.3.0 prior to 5.3.3"
},
{
"version_value": "from 5.4.0 prior to 5.4.1"
}
]
}
}
]
},
"vendor_name": "Atlassian"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version 5.4.0 before version 5.4.1 allows remote attackers to write files to disk potentially allowing them to gain code execution, exploit CVE-2017-1000117 if a vulnerable version of git is in use, and or determine if an internal service exists via an argument injection vulnerability in the at parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Argument Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "103038",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/103038"
},
{
"name": "https://jira.atlassian.com/browse/BSERV-10593",
"refsource": "CONFIRM",
"url": "https://jira.atlassian.com/browse/BSERV-10593"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2017-18087",
"datePublished": "2018-02-15T13:00:00Z",
"dateReserved": "2018-02-01T00:00:00",
"dateUpdated": "2024-09-17T01:56:57.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2017-18087\",\"sourceIdentifier\":\"security@atlassian.com\",\"published\":\"2018-02-15T13:29:00.250\",\"lastModified\":\"2019-10-03T00:03:26.223\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version 5.4.0 before version 5.4.1 allows remote attackers to write files to disk potentially allowing them to gain code execution, exploit CVE-2017-1000117 if a vulnerable version of git is in use, and or determine if an internal service exists via an argument injection vulnerability in the at parameter.\"},{\"lang\":\"es\",\"value\":\"El recurso download commit en Atlassian Bitbucket Server, desde la versi\u00f3n 5.1.0 anterior a la versi\u00f3n 5.1.7, desde la versi\u00f3n 5.2.0 anterior a la versi\u00f3n 5.2.5, desde la versi\u00f3n 5.3.0 anterior a la versi\u00f3n 5.3.3 y desde la versi\u00f3n 5.4.0 anterior a la versi\u00f3n 5.4.1, permite que atacantes remotos escriban archivos en el disco, permiti\u00e9ndoles que puedan ejecutar c\u00f3digo, explotar CVE-2017-1000117 si se est\u00e1 empleando una versi\u00f3n vulnerable de git o para determinar si existe un servicio interno por medio de una vulnerabilidad de inyecci\u00f3n de argumentos en el par\u00e1metro at.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:P/I:P/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":6.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":6.8,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.1.0\",\"versionEndExcluding\":\"5.1.7\",\"matchCriteriaId\":\"8016084B-D350-4BEB-8DF5-8535B0731E4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.2.0\",\"versionEndExcluding\":\"5.2.5\",\"matchCriteriaId\":\"CD7D36AD-BC10-4E62-8425-E192FE08404D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.3.0\",\"versionEndExcluding\":\"5.3.3\",\"matchCriteriaId\":\"5DE43F75-BEBE-4F4F-A913-6FE0B8EF0FE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*\",\"versionStartExcluding\":\"5.4.0\",\"versionEndExcluding\":\"5.4.1\",\"matchCriteriaId\":\"F191B55F-E311-4B7C-90CA-0089D2044E6A\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/103038\",\"source\":\"security@atlassian.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://jira.atlassian.com/browse/BSERV-10593\",\"source\":\"security@atlassian.com\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
Loading...