CVE-2017-16857: Race Condition
It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end. This allows an attacker to merge any code into unsuspecting repositories. This affects all versions of the auto-unapprove plugin, however since the auto-unapprove plugin is not bundled with Bitbucket Server it does not affect any particular version of Bitbucket.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16857?
CVE-2017-16857 has a high severity rating as it allows attackers to bypass the auto-unapprove functionality and merge unauthorized code.
How do I fix CVE-2017-16857?
To fix CVE-2017-16857, upgrade the Atlassian Bitbucket Auto Unapprove Plugin to the latest version available from Atlassian.
Which versions of the Auto Unapprove Plugin are affected by CVE-2017-16857?
CVE-2017-16857 affects all versions of the Atlassian Bitbucket Auto Unapprove Plugin.
What potential impact does CVE-2017-16857 have on repositories?
CVE-2017-16857 enables attackers to merge any code into repositories without proper approval, potentially leading to unauthorized changes.
Is there a workaround for CVE-2017-16857?
There is no widely documented workaround for CVE-2017-16857; the best method is to upgrade to a patched version.