CVE-2017-18037
published 2018-02-02CVE-2017-18037: The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from version 5.0.0 before…
medium6.5CVSS 3.0
AVNACLPRLUINSUCHINAN
The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from version 5.0.0 before 5.0.9 (the fixed version for 5.0.x), from version 5.1.0 before 5.1.8 (the fixed version for 5.1.x), from version 5.2.0 before 5.2.6 (the fixed version for 5.2.x), from version 5.3.0 before 5.3.4 (the fixed version for 5.3.x), from version 5.4.0 before 5.4.2 (the fixed version for 5.4.x), from version 5.5.0 before 5.5.1 (the fixed version for 5.5.x) and before 5.6.0 allows remote attackers to read arbitrary files via a path traversal vulnerability through the name of a git tag.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | bitbucket | — | — |
| atlassian | bitbucket | — | — |
| atlassian | bitbucket | — | — |
| atlassian | bitbucket | — | — |
| atlassian | bitbucket | — | — |
| atlassian | bitbucket | — | — |
| atlassian | bitbucket | >= 3.7.0 < 4.14.11 | 4.14.11 |
| atlassian | bitbucket | >= 5.0.0 < 5.0.9 | 5.0.9 |
| atlassian | bitbucket | >= 5.1.0 < 5.1.8 | 5.1.8 |
| atlassian | bitbucket | >= 5.2.0 < 5.2.6 | 5.2.6 |
| atlassian | bitbucket | >= 5.3.0 < 5.3.4 | 5.3.4 |
| atlassian | bitbucket | >= 5.4.0 < 5.4.2 | 5.4.2 |
| atlassian | bitbucket_server | — | — |
| atlassian | bitbucket_server | — | — |
| atlassian | bitbucket_server | — | — |
| atlassian | bitbucket_server | — | — |
| atlassian | bitbucket_server | — | — |
| atlassian | bitbucket_server | — | — |
| atlassian | bitbucket_server | — | — |