Uploaded image for project: 'Bitbucket Data Center'
  1. Bitbucket Data Center
  2. BSERV-10439

Race condition in auto-unapprove plugin - CVE-2017-16857

XMLWordPrintable

      It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end.
      This allows an attacker to merge any code into unsuspecting repositories.

      All versions before version 3.0.1 of the auto-unapprove plugin are affected, however since the auto-unapprove plugin is not bundled with Bitbucket Server it does not affect any particular version of Bitbucket

            [BSERV-10439] Race condition in auto-unapprove plugin - CVE-2017-16857

            Matt Hart (Inactive) added a comment -

            CVSS v3 score: 8.5 => High severity

            Exploitability Metrics

            Attack Vector Network
            Attack Complexity High
            Privileges Required Low
            User Interaction None

            Scope Metric

            Scope Changed

            Impact Metrics

            Confidentiality High
            Integrity High
            Availability High

            Matt Hart (Inactive) added a comment - CVSS v3 score: 8.5 => High severity Exploitability Metrics Attack Vector Network Attack Complexity High Privileges Required Low User Interaction None Scope Metric Scope Changed Impact Metrics Confidentiality High Integrity High Availability High

            Kristy added a comment -

            Fixed in 3.0.1 of stash-auto-unapprove-plugin

            Kristy added a comment - Fixed in 3.0.1 of stash-auto-unapprove-plugin

            Kristy added a comment -

            This is being fixed in https://bitbucket.org/atlassian/stash-auto-unapprove-plugin/pull-requests/27/bserv-10439-add-merge-check-that-prevents

            Kristy added a comment - This is being fixed in https://bitbucket.org/atlassian/stash-auto-unapprove-plugin/pull-requests/27/bserv-10439-add-merge-check-that-prevents

              khughes@atlassian.com Kristy
              khughes@atlassian.com Kristy
              Affected customers:
              0 This affects my team
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: