CVE-2019-20097
First published: Wed Jan 15 2020(Updated: )
Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the post-receive hook. A remote attacker with permission to clone and push files to a repository on the victim's Bitbucket Server or Bitbucket Data Center instance, can exploit this vulnerability to execute arbitrary commands on the Bitbucket Server or Bitbucket Data Center systems, using a file with specially crafted content.
Credit: security@atlassian.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Atlassian Bitbucket | >=1.0.0<5.6.11 | |
| Atlassian Bitbucket | >=6.0.0<6.0.11 | |
| Atlassian Bitbucket | >=6.1.0<6.1.9 | |
| Atlassian Bitbucket | >=6.2.0<6.2.7 | |
| Atlassian Bitbucket | >=6.3.0<6.3.6 | |
| Atlassian Bitbucket | >=6.4.0<6.4.4 | |
| Atlassian Bitbucket | >=6.5.0<6.5.3 | |
| Atlassian Bitbucket | >=6.6.0<6.6.3 | |
| Atlassian Bitbucket | >=6.7.0<6.7.3 | |
| Atlassian Bitbucket | >=6.8.0<6.8.2 | |
| Atlassian Bitbucket | >=6.9.0<6.9.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-20097?
CVE-2019-20097 is a vulnerability in Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, and from version 6.9.0 before 6.9.1.
What is the severity of CVE-2019-20097?
The severity of CVE-2019-20097 is high, with a CVSS score of 8.8.
Which versions of Bitbucket Server and Bitbucket Data Center are affected by CVE-2019-20097?
Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, and from version 6.9.0 before 6.9.1 are affected by CVE-2019-20097.
What is the vulnerability type of CVE-2019-20097?
The vulnerability type of CVE-2019-20097 is not specified.
How can I fix CVE-2019-20097?
To fix CVE-2019-20097, it is recommended to upgrade Bitbucket Server and Bitbucket Data Center to version 5.16.11, 6.0.11, 6.1.9, 6.2.7, 6.3.6, 6.4.4, 6.5.3, 6.6.3, 6.7.3, 6.8.2, or 6.9.1, depending on the version you are currently using.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/first-publish-date
- agent/remedy
- agent/severity
- agent/references
- agent/description
- agent/tags
- agent/event
- vendor/atlassian
- canonical/atlassian bitbucket
- version/atlassian bitbucket/1.0.0
- version/atlassian bitbucket/6.0.0
- version/atlassian bitbucket/6.1.0
- version/atlassian bitbucket/6.2.0
- version/atlassian bitbucket/6.3.0
- version/atlassian bitbucket/6.4.0
- version/atlassian bitbucket/6.5.0
- version/atlassian bitbucket/6.6.0
- version/atlassian bitbucket/6.7.0
- version/atlassian bitbucket/6.8.0
- version/atlassian bitbucket/6.9.0