PT-2023-5577 · Atlassian · Bitbucket Data Center/Server+1

Publicado 2023-09-19 · Atualizado 2023-11-14 · CVE-2023-22513

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bitbucket Data Center and Server versions 8.0.0 through 8.9.4 Bitbucket Data Center and Server versions 8.10.0 through 8.10.4 Bitbucket Data Center and Server versions 8.11.0 through 8.11.3 Bitbucket Data Center and Server versions 8.12.0 through 8.12.1 Bitbucket Data Center and Server versions 8.13.0 through 8.13.0 Bitbucket Data Center and Server versions 8.14.0 through 8.14.0

Description This issue is related to a high severity Remote Code Execution vulnerability in Bitbucket Data Center and Server. The vulnerability allows an authenticated attacker to execute arbitrary code, which has a high impact on confidentiality, integrity, and availability, and requires no user interaction. It is estimated that around 2,064 devices may be affected. There have been reports of real-world incidents where this issue was exploited to implant a webshell, allowing persistence even after the vulnerability is patched.

Recommendations For Bitbucket Data Center and Server 8.9: Upgrade to a release greater than or equal to 8.9.5 For Bitbucket Data Center and Server 8.10: Upgrade to a release greater than or equal to 8.10.5 For Bitbucket Data Center and Server 8.11: Upgrade to a release greater than or equal to 8.11.4 For Bitbucket Data Center and Server 8.12: Upgrade to a release greater than or equal to 8.12.2 For Bitbucket Data Center and Server 8.13: Upgrade to a release greater than or equal to 8.13.1 For Bitbucket Data Center and Server 8.14: Upgrade to a release greater than or equal to 8.14.0 For Bitbucket Data Center and Server version >= 8.0 and < 8.9: Upgrade to any of the listed fix versions.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-20

CWE-94

Identificadores relacionados

BDU:2023-06228

CVE-2023-22513

Produtos afetados

Bitbucket

Bitbucket Data Center/Server

Referências · 25

• https://osv.dev/vulnerability/CVE-2023-22513 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22513 · Nota de Segurança
• https://jira.atlassian.com/browse/BSERV-14419 · Aviso do Fabricante
• https://confluence.atlassian.com/security/security-bulletin-september-19-2023-1283691616.html · Nota
• https://twitter.com/Redpatronus/status/1710266786245988756 · Publicação no Twitter
• https://t.me/true_secator/4880 · Publicação no Telegram
• https://twitter.com/DMFezzaReedCISA/status/1704364004343165122 · Publicação no Twitter
• https://twitter.com/Komodosec/status/1704440803211567226 · Publicação no Twitter
• https://cybersecurity-help.cz/vdb/SB2023092532 · Nota
• https://twitter.com/CVEnew/status/1704182037500879140 · Publicação no Twitter
• https://twitter.com/CCBalert/status/1705146291519451634 · Publicação no Twitter
• https://vuldb.com/ru/?id.239979 · Nota
• https://twitter.com/the_yellow_fall/status/1704342709874688048 · Publicação no Twitter
• https://t.me/pentestingnews/39504 · Publicação no Telegram
• https://twitter.com/fridaysecurity/status/1704343519739936872 · Publicação no Twitter