8.8
Advisory Published
Updated

CVE-2019-20097

First published: Wed Jan 15 2020(Updated: )

Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the post-receive hook. A remote attacker with permission to clone and push files to a repository on the victim's Bitbucket Server or Bitbucket Data Center instance, can exploit this vulnerability to execute arbitrary commands on the Bitbucket Server or Bitbucket Data Center systems, using a file with specially crafted content.

Credit: security@atlassian.com

Affected SoftwareAffected VersionHow to fix
Atlassian Bitbucket>=1.0.0<5.6.11
Atlassian Bitbucket>=6.0.0<6.0.11
Atlassian Bitbucket>=6.1.0<6.1.9
Atlassian Bitbucket>=6.2.0<6.2.7
Atlassian Bitbucket>=6.3.0<6.3.6
Atlassian Bitbucket>=6.4.0<6.4.4
Atlassian Bitbucket>=6.5.0<6.5.3
Atlassian Bitbucket>=6.6.0<6.6.3
Atlassian Bitbucket>=6.7.0<6.7.3
Atlassian Bitbucket>=6.8.0<6.8.2
Atlassian Bitbucket>=6.9.0<6.9.1

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is CVE-2019-20097?

    CVE-2019-20097 is a vulnerability in Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, and from version 6.9.0 before 6.9.1.

  • What is the severity of CVE-2019-20097?

    The severity of CVE-2019-20097 is high, with a CVSS score of 8.8.

  • Which versions of Bitbucket Server and Bitbucket Data Center are affected by CVE-2019-20097?

    Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, and from version 6.9.0 before 6.9.1 are affected by CVE-2019-20097.

  • What is the vulnerability type of CVE-2019-20097?

    The vulnerability type of CVE-2019-20097 is not specified.

  • How can I fix CVE-2019-20097?

    To fix CVE-2019-20097, it is recommended to upgrade Bitbucket Server and Bitbucket Data Center to version 5.16.11, 6.0.11, 6.1.9, 6.2.7, 6.3.6, 6.4.4, 6.5.3, 6.6.3, 6.7.3, 6.8.2, or 6.9.1, depending on the version you are currently using.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203