CVE-2018-5225

published 2018-03-22

CVE-2018-5225: In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed…

Priority P2 61 critical 9.9 CVSS 3.0

AV N AC L PR L UI N S C C H I H A H

In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x), allows authenticated users to gain remote code execution using the in browser editing feature via editing a symbolic link within a repository.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
atlassian	bitbucket	< 5.5.8	5.5.8
atlassian	bitbucket	>= 4.13.0 < 5.4.8	5.4.8
atlassian	bitbucket	>= 5.6.0 < 5.6.5	5.6.5
atlassian	bitbucket	>= 5.7.0 < 5.7.3	5.7.3
atlassian	bitbucket	>= 5.8.0 < 5.8.2	5.8.2
atlassian	bitbucket_server	>= 4.13.0 < unspecified	unspecified
atlassian	bitbucket_server	>= 5.5.0 < unspecified	unspecified
atlassian	bitbucket_server	>= 5.6.0 < unspecified	unspecified
atlassian	bitbucket_server	>= 5.7.0 < unspecified	unspecified
atlassian	bitbucket_server	>= 5.8.0 < unspecified	unspecified
atlassian	bitbucket_server	>= unspecified < 5.4.8	5.4.8
atlassian	bitbucket_server	>= unspecified < 5.5.8	5.5.8
atlassian	bitbucket_server	>= unspecified < 5.6.5	5.6.5
atlassian	bitbucket_server	>= unspecified < 5.7.3	5.7.3
atlassian	bitbucket_server	>= unspecified < 5.8.2	5.8.2

CVSS provenance

nvd v3.0 9.9 CRITICAL CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-59