CVE-2019-15012

published 2020-01-15

CVE-2019-15012: Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version…

Priority P3 58 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint, if the user has Bitbucket Server or Bitbucket Data Center running, and has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance.

Affected

55 ranges · showing 25

Vendor	Product	Version range	Fixed in
atlassian	bitbucket	>= 4.13.0 < 5.6.11	5.6.11
atlassian	bitbucket	>= 6.0.0 < 6.0.11	6.0.11
atlassian	bitbucket	>= 6.1.0 < 6.1.9	6.1.9
atlassian	bitbucket	>= 6.2.0 < 6.2.7	6.2.7
atlassian	bitbucket	>= 6.3.0 < 6.3.6	6.3.6
atlassian	bitbucket	>= 6.4.0 < 6.4.4	6.4.4
atlassian	bitbucket	>= 6.5.0 < 6.5.3	6.5.3
atlassian	bitbucket	>= 6.6.0 < 6.6.3	6.6.3
atlassian	bitbucket	>= 6.7.0 < 6.7.3	6.7.3
atlassian	bitbucket	>= 6.8.0 < 6.8.2	6.8.2
atlassian	bitbucket	>= 6.9.0 < 6.9.1	6.9.1
atlassian	bitbucket_data_center	>= 4.13 < unspecified	unspecified
atlassian	bitbucket_data_center	>= 6.0 < unspecified	unspecified
atlassian	bitbucket_data_center	>= 6.1.0 < unspecified	unspecified
atlassian	bitbucket_data_center	>= 6.2.0 < unspecified	unspecified
atlassian	bitbucket_data_center	>= 6.3.0 < unspecified	unspecified
atlassian	bitbucket_data_center	>= 6.4.0 < unspecified	unspecified
atlassian	bitbucket_data_center	>= 6.5.0 < unspecified	unspecified
atlassian	bitbucket_data_center	>= 6.6.0 < unspecified	unspecified
atlassian	bitbucket_data_center	>= 6.7.0 < unspecified	unspecified
atlassian	bitbucket_data_center	>= 6.8.0 < unspecified	unspecified
atlassian	bitbucket_data_center	>= 6.9.0 < unspecified	unspecified
atlassian	bitbucket_data_center	>= unspecified < 5.16.11	5.16.11
atlassian	bitbucket_data_center	>= unspecified < 6.0.11	6.0.11
atlassian	bitbucket_data_center	>= unspecified < 6.1.9	6.1.9

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-269