Lucene search

[email protected]CVE-2019-15010

HistoryJan 15, 2020 - 9:15 p.m.

CVE-2019-15010

2020-01-1521:15:12

CWE-77

[email protected]

web.nvd.nist.gov

bitbucket

server

data center

cve-2019-15010

remote code execution

vulnerability

user input

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.8%

JSON

Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, and from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via certain user input fields. A remote attacker with user level permissions can exploit this vulnerability to run arbitrary commands on the victim’s systems. Using a specially crafted payload as user input, the attacker can execute arbitrary commands on the victim’s Bitbucket Server or Bitbucket Data Center instance.

Affected configurations

NVD

Node

atlassianbitbucketRange3.0.0–5.6.11

atlassianbitbucketRange6.0.0–6.0.11

atlassianbitbucketRange6.1.0–6.1.9

atlassianbitbucketRange6.2.0–6.2.7

atlassianbitbucketRange6.3.0–6.3.6

atlassianbitbucketRange6.4.0–6.4.4

atlassianbitbucketRange6.5.0–6.5.3

atlassianbitbucketRange6.6.0–6.6.3

atlassianbitbucketRange6.7.0–6.7.3

atlassianbitbucketRange6.8.0–6.8.2

atlassianbitbucketRange6.9.0–6.9.1

CPENameOperatorVersion
atlassian:bitbucketatlassian bitbucketlt5.6.11
atlassian:bitbucketatlassian bitbucketlt6.0.11
atlassian:bitbucketatlassian bitbucketlt6.1.9
atlassian:bitbucketatlassian bitbucketlt6.2.7
atlassian:bitbucketatlassian bitbucketlt6.3.6
atlassian:bitbucketatlassian bitbucketlt6.4.4
atlassian:bitbucketatlassian bitbucketlt6.5.3
atlassian:bitbucketatlassian bitbucketlt6.6.3
atlassian:bitbucketatlassian bitbucketlt6.7.3
atlassian:bitbucketatlassian bitbucketlt6.8.2

CPE	Name	Operator	Version
atlassian:bitbucket	atlassian bitbucket	lt	5.6.11
atlassian:bitbucket	atlassian bitbucket	lt	6.0.11
atlassian:bitbucket	atlassian bitbucket	lt	6.1.9
atlassian:bitbucket	atlassian bitbucket	lt	6.2.7
atlassian:bitbucket	atlassian bitbucket	lt	6.3.6
atlassian:bitbucket	atlassian bitbucket	lt	6.4.4
atlassian:bitbucket	atlassian bitbucket	lt	6.5.3
atlassian:bitbucket	atlassian bitbucket	lt	6.6.3
atlassian:bitbucket	atlassian bitbucket	lt	6.7.3
atlassian:bitbucket	atlassian bitbucket	lt	6.8.2

Rows per page:

1-10 of 111

CNA Affected

[
  {
    "product": "Bitbucket Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "3.0",
        "versionType": "custom"
      },
      {
        "lessThan": "5.16.11",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.0.11",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.1.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.1.9",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.2.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.2.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.3.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.3.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.4.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.4.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.5.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.5.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.6.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.6.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.7.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.7.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.8.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.8.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.9.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.9.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Bitbucket Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "3.0",
        "versionType": "custom"
      },
      {
        "lessThan": "5.16.11",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.0.11",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.1.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.1.9",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.2.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.2.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.3.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.3.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.4.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.4.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.5.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.5.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.6.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.6.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.7.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.7.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.8.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.8.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.9.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.9.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

jira.atlassian.com/browse/BSERV-12098

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.8%

JSON

Related for CVE-2019-15010

cvelist1 nvd1 prion1