PT-2023-5577 · Atlassian · Bitbucket Data Center/Server+1

Published 2023-09-19 · Updated 2023-11-14 · CVE-2023-22513

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bitbucket Data Center and Server versions 8.0.0 through 8.9.4 Bitbucket Data Center and Server versions 8.10.0 through 8.10.4 Bitbucket Data Center and Server versions 8.11.0 through 8.11.3 Bitbucket Data Center and Server versions 8.12.0 through 8.12.1 Bitbucket Data Center and Server versions 8.13.0 through 8.13.0 Bitbucket Data Center and Server versions 8.14.0 through 8.14.0

Description This issue is related to a high severity Remote Code Execution vulnerability in Bitbucket Data Center and Server. The vulnerability allows an authenticated attacker to execute arbitrary code, which has a high impact on confidentiality, integrity, and availability, and requires no user interaction. It is estimated that around 2,064 devices may be affected. There have been reports of real-world incidents where this issue was exploited to implant a webshell, allowing persistence even after the vulnerability is patched.

Recommendations For Bitbucket Data Center and Server 8.9: Upgrade to a release greater than or equal to 8.9.5 For Bitbucket Data Center and Server 8.10: Upgrade to a release greater than or equal to 8.10.5 For Bitbucket Data Center and Server 8.11: Upgrade to a release greater than or equal to 8.11.4 For Bitbucket Data Center and Server 8.12: Upgrade to a release greater than or equal to 8.12.2 For Bitbucket Data Center and Server 8.13: Upgrade to a release greater than or equal to 8.13.1 For Bitbucket Data Center and Server 8.14: Upgrade to a release greater than or equal to 8.14.0 For Bitbucket Data Center and Server version >= 8.0 and < 8.9: Upgrade to any of the listed fix versions.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-20

CWE-94

Related Identifiers

BDU:2023-06228

CVE-2023-22513

Affected Products

Bitbucket

Bitbucket Data Center/Server

References · 25

• https://osv.dev/vulnerability/CVE-2023-22513 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22513 · Security Note
• https://jira.atlassian.com/browse/BSERV-14419 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06228 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-22513 · Security Note
• https://confluence.atlassian.com/pages/viewpage.action?pageId=1283691616 · Vendor Advisory
• https://confluence.atlassian.com/security/security-bulletin-september-19-2023-1283691616.html · Note
• https://twitter.com/Redpatronus/status/1710266786245988756 · Twitter Post
• https://t.me/true_secator/4880 · Telegram Post
• https://twitter.com/DMFezzaReedCISA/status/1704364004343165122 · Twitter Post
• https://twitter.com/Komodosec/status/1704440803211567226 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023092532 · Note
• https://twitter.com/CVEnew/status/1704182037500879140 · Twitter Post
• https://twitter.com/CCBalert/status/1705146291519451634 · Twitter Post
• https://vuldb.com/ru/?id.239979 · Note