High The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from version 5.0.0 before 5.0.9 (the fixed version for 5.0.x), from version 5.1.0 before 5.1.8 (the fixed version for 5.1.x), from version 5.2.0 before 5.2.6 (the fixed version for 5.2.x), from version 5.3.0 before 5.3.4 (the fixed version for 5.3.x), from version 5.4.0 before 5.4.2 (the fixed version for 5.4.x), from version 5.5.0 before 5.5.1 (the fixed version for 5.5.x) and before 5.6.0 allows remote attackers to read arbitrary files via a path traversal vulnerability through the name of a git tag.
- mentioned in
-
Page Failed to load
| Form Name | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
[BSERV-10595] Path traversal through the name of a git tag in the git repository tag rest resource - CVE-2017-18037
| Labels | Original: CVE-2017-18037 advisory advisory-released bugbounty cvss-high path-traversal security | New: CVE-2017-18037 advisory advisory-released bugbounty cvss-high idor path-traversal security |
| Workflow | Original: Stash Workflow - Restricted [ 2594830 ] | New: JAC Bug Workflow v3 [ 3137319 ] |
| Symptom Severity | Original: Major [ 14431 ] | New: Severity 2 - Major [ 15831 ] |
| Remote Link | New: This issue links to "Page (Confluence)" [ 389525 ] |
| Labels | Original: CVE-2017-18037 advisory advisory-to-release bugbounty cvss-high path-traversal security | New: CVE-2017-18037 advisory advisory-released bugbounty cvss-high path-traversal security |
| Description | Original: The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from version 5.0.0 before 5.0.9 (the fixed version for 5.0.x), from version 5.1.0 before 5.1.8 (the fixed version for 5.1.x), from version 5.2.0 before 5.2.6 (the fixed version for 5.2.x), from 5.3.0 before 5.3.4 (the fixed version for 5.3.x), from version 5.4.0 before 5.4.2 (the fixed version for 5.4.x), from version 5.5.0 before 5.5.1 (the fixed version for 5.5.x) and before 5.6.0 allows remote attackers to read arbitrary files via a path traversal vulnerability through the name of a git tag. | New: The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from version 5.0.0 before 5.0.9 (the fixed version for 5.0.x), from version 5.1.0 before 5.1.8 (the fixed version for 5.1.x), from version 5.2.0 before 5.2.6 (the fixed version for 5.2.x), from version 5.3.0 before 5.3.4 (the fixed version for 5.3.x), from version 5.4.0 before 5.4.2 (the fixed version for 5.4.x), from version 5.5.0 before 5.5.1 (the fixed version for 5.5.x) and before 5.6.0 allows remote attackers to read arbitrary files via a path traversal vulnerability through the name of a git tag. |
| Description | Original: The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before version 4.14.11 (the fixed version for 4.14.x), 5.0.9 (the fixed version for 5.0.x), 5.1.8 (the fixed version for 5.1.x), 5.2.6 (the fixed version for 5.2.x), 5.3.4 (the fixed version for 5.3.x), 5.4.2 (the fixed version for 5.4.x), 5.5.1 (the fixed version for 5.5.x) and 5.6.0 allows remote attackers to read arbitrary files via a path traversal vulnerability through the name of a git tag. | New: The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from version 5.0.0 before 5.0.9 (the fixed version for 5.0.x), from version 5.1.0 before 5.1.8 (the fixed version for 5.1.x), from version 5.2.0 before 5.2.6 (the fixed version for 5.2.x), from 5.3.0 before 5.3.4 (the fixed version for 5.3.x), from version 5.4.0 before 5.4.2 (the fixed version for 5.4.x), from version 5.5.0 before 5.5.1 (the fixed version for 5.5.x) and before 5.6.0 allows remote attackers to read arbitrary files via a path traversal vulnerability through the name of a git tag. |
| Description | Original: The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before version 4.14.11 (the fixed version for 4.14.x), 5.0.9 (the fixed version for 5.0.x), 5.1.8 (the fixed version for 5.1.x), 5.2.6 (the fixed version for 5.2.x), 5.3.4 (the fixed version for 5.3.x), 5.4.2 (the fixed version for 5.4.x), 5.5.1 (the fixed version for 5.5.x) and 5.6.0 allows remote attackers to read arbitrary files via a path traversal vulnerability in handling the name of a git tag. | New: The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before version 4.14.11 (the fixed version for 4.14.x), 5.0.9 (the fixed version for 5.0.x), 5.1.8 (the fixed version for 5.1.x), 5.2.6 (the fixed version for 5.2.x), 5.3.4 (the fixed version for 5.3.x), 5.4.2 (the fixed version for 5.4.x), 5.5.1 (the fixed version for 5.5.x) and 5.6.0 allows remote attackers to read arbitrary files via a path traversal vulnerability through the name of a git tag. |
| Labels | Original: advisory advisory-to-release bugbounty cvss-high path-traversal security | New: CVE-2017-18037 advisory advisory-to-release bugbounty cvss-high path-traversal security |
| Summary | Original: Sanitised security issue 31b253be0ae3ad281ba8bdf0a804c0851b6fcdfe4f5efe435538f64bb3548bee | New: Path traversal through the name of a git tag in the git repository tag rest resource - CVE-2017-18037 |