Atlassian Bitbucket Server
18 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2023-22513 | >= 8.0.0 ; >= 8.1.0 ; >= 8.10.0 ; … | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE ( | HIGH 8.8 | 15 % | ||
| CVE-2022-43781 | before 7.17.12 ; before 7.21.6 ; before 7.6.19 ; … | There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to c | CRITICAL 9.8 | 98 % | ||
| CVE-2022-36804 | 7.0.0 – < unspecified ; unspecified – < 7.6.17 ; 7.7.0 – < unspecified ; … | Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, | HIGH 8.8 | 99 % | KEV | |
| CVE-2022-26137 | unspecified – < 7.6.16 ; 7.7.0 – < unspecified ; 7.16.0 – < unspecified ; … | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked w | HIGH 8.8 | 2.4 % | ||
| CVE-2022-26136 | unspecified – < 7.6.16 ; 7.7.0 – < unspecified ; 7.16.0 – < unspecified ; … | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third p | CRITICAL 9.8 | 5.7 % | ||
| CVE-2020-36233 | unspecified – < 6.10.9 ; 7.0.0 – < unspecified ; unspecified – < 7.6.4 ; … | The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7 | HIGH 7.8 | 0.3 % | ||
| CVE-2020-14170 | 5.4.0 – < unspecified ; unspecified – < 7.3.1 | Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal netw | MEDIUM 4.3 | 0.8 % | ||
| CVE-2020-14171 | 4.9.0 – < unspecified ; unspecified – < 7.2.4 | Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import reques | MEDIUM 6.5 | 0.6 % | ||
| CVE-2019-20097 | 1.0 – < unspecified ; unspecified – < 5.16.11 ; 6.0 – < unspecified ; … | Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 | HIGH 8.8 | 2.5 % | ||
| CVE-2019-15012 | 4.13 – < unspecified ; unspecified – < 5.16.11 ; 6.0 – < unspecified ; … | Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6. | HIGH 8.8 | 1.6 % | ||
| CVE-2019-15010 | 3.0 – < unspecified ; unspecified – < 5.16.11 ; 6.0 – < unspecified ; … | Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, fr | HIGH 8.8 | 2.6 % | ||
| CVE-2019-15005 | unspecified – < 6.6.0 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans an | MEDIUM 4.3 | 1.3 % | ||
| CVE-2019-15000 | unspecified – < 5.16.10 ; 6.0.0 – < unspecified ; unspecified – < 6.0.10 ; … | The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x ), from 6.0.0 before 6.0.10 ( | CRITICAL 9.8 | 7.8 % | ||
| CVE-2018-5225 | 4.13.0 – < unspecified ; unspecified – < 5.4.8 ; 5.5.0 – < unspecified ; … | In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before | CRITICAL 9.9 | 3.4 % | ||
| CVE-2017-18087 | from 5.1.0 prior to 5.1.7 ; from 5.2.0 prior to 5.2.5 ; from 5.3.0 prior to 5.3.3 ; … | The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, | HIGH 7.5 | 1.8 % | ||
| CVE-2017-18038 | prior to 5.6.0 | The repository settings resource in Atlassian Bitbucket Server before version 5.6.0 allows remote attackers to read the first line of arbitr | MEDIUM 5.3 | 1.4 % | ||
| CVE-2017-18037 | from 3.7.0 prior to 4.14.11 ; from 5.0.0 prior to 5.0.9 ; from 5.1.0 prior to 5.1.8 ; … | The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from ve | MEDIUM 6.5 | 1.3 % | ||
| CVE-2017-18036 | prior to 5.3.0 | The Github repository importer in Atlassian Bitbucket Server before version 5.3.0 allows remote attackers to determine if a service they cou | MEDIUM 4.3 | 0.9 % |