CVE-2018-5225

published 2018-03-22

CVE-2018-5225: In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed…

critical 9.9 CVSS 3.0

AV N AC L PR L UI N S C C H I H A H

In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x), allows authenticated users to gain remote code execution using the in browser editing feature via editing a symbolic link within a repository.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
atlassian	bitbucket	< 5.5.8	5.5.8
atlassian	bitbucket	>= 4.13.0 < 5.4.8	5.4.8
atlassian	bitbucket	>= 5.6.0 < 5.6.5	5.6.5
atlassian	bitbucket	>= 5.7.0 < 5.7.3	5.7.3
atlassian	bitbucket	>= 5.8.0 < 5.8.2	5.8.2
atlassian	bitbucket_server	>= 4.13.0 < unspecified	unspecified
atlassian	bitbucket_server	>= 5.5.0 < unspecified	unspecified
atlassian	bitbucket_server	>= 5.6.0 < unspecified	unspecified
atlassian	bitbucket_server	>= 5.7.0 < unspecified	unspecified
atlassian	bitbucket_server	>= 5.8.0 < unspecified	unspecified
atlassian	bitbucket_server	>= unspecified < 5.4.8	5.4.8
atlassian	bitbucket_server	>= unspecified < 5.5.8	5.5.8
atlassian	bitbucket_server	>= unspecified < 5.6.5	5.6.5
atlassian	bitbucket_server	>= unspecified < 5.7.3	5.7.3
atlassian	bitbucket_server	>= unspecified < 5.8.2	5.8.2

CWE-59