CVE-2019-3397
Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 b…
Published 7 y ago · modified 4 mo ago · JSON
Summary
Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 before 5.14.4 (fixed version for 5.14.x), from 5.15.0 before 5.15.3 (fixed version for 5.15.x), from 5.16.0 before 5.16.3 (fixed version for 5.16.x), from 6.0.0 before 6.0.3 (fixed version for 6.0.x), and from 6.1.0 before 6.1.2 (the fixed version for 6.1.x) allow remote attackers who have admin permissions to achieve remote code execution on a Bitbucket server instance via path traversal through the Data Center migration tool.
Exploit prediction (EPSS)
4.40% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.1 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Affected products
- Atlassian Bitbucket Data Center
Classification
- Weakness
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- jira.atlassian.com /browse/BSERV-11706 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2019-3397
- NVD: CVE-2019-3397
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.