CRITICAL🇵🇱 Wersja polska

CVE-2018-5225

CVSS 9.9v3.0pub. 2018-03-22upd. 2024-11-21

In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x), allows authenticated users to gain remote code execution using the in browser editing feature via editing a symbolic link within a repository.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Atlassian Bitbucket

    APP
    Atlassian
    4.13.0 – 5.4.8 (excl.)< 5.5.85.6.0 – 5.6.5 (excl.)5.7.0 – 5.7.3 (excl.)5.8.0 – 5.8.2 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2022-43781CRITICAL9.8PL ✓same product

Command injection w Bitbucket Server i Data Center przez zmienne środowiskowe

CVE-2022-26136CRITICAL9.8PL ✓same product

Atlassian — pominięcie Servlet Filters umożliwia auth bypass i XSS

CVE-2019-15000CRITICAL9.8PL ✓same product

Command injection w Atlassian Bitbucket Server i Data Center via commit diff endpoint

CVE-2019-3397CRITICAL9.1PL ✓same product

RCE przez path traversal w narzędziu migracji Atlassian Bitbucket Data Center

CVE-2022-36804HIGH8.8⚠ KEVsame product

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version...