CVE-2019-3397: Path Traversal
Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 before 5.14.4 (fixed version for 5.14.x), from 5.15.0 before 5.15.3 (fixed version for 5.15.x), from 5.16.0 before 5.16.3 (fixed version for 5.16.x), from 6.0.0 before 6.0.3 (fixed version for 6.0.x), and from 6.1.0 before 6.1.2 (the fixed version for 6.1.x) allow remote attackers who have admin permissions to achieve remote code execution on a Bitbucket server instance via path traversal through the Data Center migration tool.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-3397?
CVE-2019-3397 is a vulnerability in Atlassian Bitbucket Data Center licensed instances that allows remote attackers to execute arbitrary commands via a path traversal vulnerability.
Which versions of Atlassian Bitbucket are affected by CVE-2019-3397?
Atlassian Bitbucket Data Center versions 5.13.0 to 5.13.6, 5.14.0 to 5.14.4, 5.15.0 to 5.15.3, 5.16.0 to 5.16.3, 6.0.0 to 6.0.3, and 6.1.0 to 6.1.2 are affected by CVE-2019-3397.
What is the severity of CVE-2019-3397?
CVE-2019-3397 has a severity rating of 9.1 (Critical).
How can an attacker exploit CVE-2019-3397?
An attacker can exploit CVE-2019-3397 by sending a specially crafted request to a vulnerable Atlassian Bitbucket instance, resulting in the execution of arbitrary commands.
Where can I find more information about CVE-2019-3397?
More information about CVE-2019-3397 can be found on the Atlassian Bitbucket issue tracker at: https://jira.atlassian.com/browse/BSERV-11706