Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-18037

The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from version 5.0.0 before 5.0.9 (the fixed version for 5.0.x), from version 5.1.0 before 5.1.8 (the fixed version for 5.1.x), from version 5.2.0 before 5.2.6 (the fixed version for 5.2.x), from version 5.3.0 before 5.3.4 (the fixed version for 5.3.x), from version 5.4.0 before 5.4.2 (the fixed version for 5.4.x), from version 5.5.0 before 5.5.1 (the fixed version for 5.5.x) and before 5.6.0 allows remote attackers to read arbitrary files via a path traversal vulnerability through the name of a git tag.

Published

2018-02-02T14:29:00.733

Last Modified

2024-11-21T03:19:13.383

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-22
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application atlassian bitbucket < 4.14.11 Yes
Application atlassian bitbucket < 5.0.9 Yes
Application atlassian bitbucket < 5.1.8 Yes
Application atlassian bitbucket < 5.2.6 Yes
Application atlassian bitbucket < 5.3.4 Yes
Application atlassian bitbucket < 5.4.2 Yes
Application atlassian bitbucket 5.5.0 Yes
Application atlassian bitbucket 5.5.2 Yes
Application atlassian bitbucket 5.5.3 Yes
Application atlassian bitbucket 5.5.4 Yes
Application atlassian bitbucket 5.5.5 Yes
Application atlassian bitbucket 5.5.6 Yes
References