CVE-2019-3397: Path Traversal
First published: Mon Jun 03 2019(Updated: )
Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 before 5.14.4 (fixed version for 5.14.x), from 5.15.0 before 5.15.3 (fixed version for 5.15.x), from 5.16.0 before 5.16.3 (fixed version for 5.16.x), from 6.0.0 before 6.0.3 (fixed version for 6.0.x), and from 6.1.0 before 6.1.2 (the fixed version for 6.1.x) allow remote attackers who have admin permissions to achieve remote code execution on a Bitbucket server instance via path traversal through the Data Center migration tool.
Credit: security@atlassian.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Atlassian Bitbucket | >=5.13.0<5.13.6 | |
| Atlassian Bitbucket | >=5.14.0<5.14.4 | |
| Atlassian Bitbucket | >=5.15.0<5.15.3 | |
| Atlassian Bitbucket | >=5.16.0<5.16.3 | |
| Atlassian Bitbucket | >=6.0.0<6.0.3 | |
| Atlassian Bitbucket | >=6.1.0<6.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-3397?
CVE-2019-3397 is a vulnerability in Atlassian Bitbucket Data Center licensed instances that allows remote attackers to execute arbitrary commands via a path traversal vulnerability.
Which versions of Atlassian Bitbucket are affected by CVE-2019-3397?
Atlassian Bitbucket Data Center versions 5.13.0 to 5.13.6, 5.14.0 to 5.14.4, 5.15.0 to 5.15.3, 5.16.0 to 5.16.3, 6.0.0 to 6.0.3, and 6.1.0 to 6.1.2 are affected by CVE-2019-3397.
What is the severity of CVE-2019-3397?
CVE-2019-3397 has a severity rating of 9.1 (Critical).
How can an attacker exploit CVE-2019-3397?
An attacker can exploit CVE-2019-3397 by sending a specially crafted request to a vulnerable Atlassian Bitbucket instance, resulting in the execution of arbitrary commands.
Where can I find more information about CVE-2019-3397?
More information about CVE-2019-3397 can be found on the Atlassian Bitbucket issue tracker at: https://jira.atlassian.com/browse/BSERV-11706
- collector/nvd-index
- vendor/atlassian
- canonical/atlassian bitbucket
- version/atlassian bitbucket/5.13.0
- version/atlassian bitbucket/5.14.0
- version/atlassian bitbucket/5.15.0
- version/atlassian bitbucket/5.16.0
- version/atlassian bitbucket/6.0.0
- version/atlassian bitbucket/6.1.0