CVE-2018-5225

In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x), allows authenticated users to gain remote code execution using the in browser editing feature via editing a symbolic link within a repository.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-03-22 13:29

Updated : 2023-12-10 12:30


NVD link : CVE-2018-5225

Mitre link : CVE-2018-5225

CVE.ORG link : CVE-2018-5225


JSON object : View

Products Affected

atlassian

  • bitbucket
CWE
CWE-59

Improper Link Resolution Before File Access ('Link Following')