PT-2019-16555 · Atlassian · Bitbucket

Publicado 2019-05-24 · Atualizado 2019-06-03 · CVE-2019-3397

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atlassian Bitbucket Data Center versions 5.13.0 through 5.13.5 Atlassian Bitbucket Data Center versions 5.14.0 through 5.14.3 Atlassian Bitbucket Data Center versions 5.15.0 through 5.15.2 Atlassian Bitbucket Data Center versions 5.16.0 through 5.16.2 Atlassian Bitbucket Data Center versions 6.0.0 through 6.0.2 Atlassian Bitbucket Data Center versions 6.1.0 through 6.1.1

Description The issue allows remote attackers with admin permissions to achieve remote code execution on a Bitbucket server instance via path traversal through the Data Center migration tool.

Recommendations For versions 5.13.0 through 5.13.5, update to version 5.13.6 or later. For versions 5.14.0 through 5.14.3, update to version 5.14.4 or later. For versions 5.15.0 through 5.15.2, update to version 5.15.3 or later. For versions 5.16.0 through 5.16.2, update to version 5.16.3 or later. For versions 6.0.0 through 6.0.2, update to version 6.0.3 or later. For versions 6.1.0 through 6.1.1, update to version 6.1.2 or later.

Correção

RCE

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-3397

Produtos afetados

Bitbucket

Referências · 5

• https://t.me/defcon_news/14617 · Publicação no Telegram
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3397 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-3397 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-3397 · Aviso do Fabricante
• https://jira.atlassian.com/browse/BSERV-11706 · Aviso do Fabricante