CVEvulnerability

CVE-2018-5225

9.9 CRITICAL Published 2018-03-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-03-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.9 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-59

Description

In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x), allows authenticated users to gain remote code execution using the in browser editing feature via editing a symbolic link within a repository.

Affected configurations

• atlassian bitbucket (>= 4.13.0 < 5.4.8) • atlassian bitbucket (> 5.5.0 < 5.5.8) • atlassian bitbucket (>= 5.6.0 < 5.6.5) • atlassian bitbucket (>= 5.7.0 < 5.7.3) • atlassian bitbucket (>= 5.8.0 < 5.8.2)

Related

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References