PT-2018-16816 · Atlassian · Bitbucket Server+1

Matt Hart · Publicado 2018-03-22 · Atualizado 2018-04-20 · CVE-2018-5225

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atlassian Bitbucket Server versions 4.13.0 through 5.4.7 Atlassian Bitbucket Server versions 5.5.0 through 5.5.7 Atlassian Bitbucket Server versions 5.6.0 through 5.6.4 Atlassian Bitbucket Server versions 5.7.0 through 5.7.2 Atlassian Bitbucket Server versions 5.8.0 through 5.8.1

Description The issue allows authenticated users to gain remote code execution using the in-browser editing feature via editing a symbolic link within a repository.

Recommendations For versions 4.13.0 through 5.4.7, update to version 5.4.8 or later. For versions 5.5.0 through 5.5.7, update to version 5.5.8 or later. For versions 5.6.0 through 5.6.4, update to version 5.6.5 or later. For versions 5.7.0 through 5.7.2, update to version 5.7.3 or later. For versions 5.8.0 through 5.8.1, update to version 5.8.2 or later.

Correção

RCE

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2018-5225

Produtos afetados

Bitbucket Server

Bitbucket

Referências · 6

• https://osv.dev/vulnerability/CVE-2018-5225 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5225 · Nota de Segurança
• http://securityfocus.com/bid/103488 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-5225 · Nota de Segurança
• https://jira.atlassian.com/browse/BSERV-10684 · Aviso do Fabricante
• https://confluence.atlassian.com/x/3WNsO · Aviso do Fabricante