CVE-2018-5225

CRITICAL

Atlassian Bitbucket 4.13.0-5.8.1 - Authenticated Remote Code Execution via Symbolic Link

Title source: llm

Description

In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x), allows authenticated users to gain remote code execution using the in browser editing feature via editing a symbolic link within a repository.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_confirm

https://jira.atlassian.com/browse/BSERV-10684

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/103488

Vendor Advisory x_refsource_confirm

https://confluence.atlassian.com/x/3WNsO

Scores

CVSS v3 9.9

EPSS 0.0269

EPSS Percentile 86.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Details

CWE

CWE-59

Status published

Products (1)

atlassian/bitbucket 4.13.0 - 5.4.8

Published Mar 22, 2018

Tracked Since Feb 18, 2026