[BSERV-12103] https://jira.atlassian.com/browse/JRASERVER-70409 for Bitbucket Server

Type: Bug
Resolution: Fixed
Priority: Low
Fix Version/s: 5.16.6, 6.0.6, 6.1.5, 6.2.2, 6.3.1, 6.4.0
Affects Version/s: 1.0
Component/s: AppLinks
Labels:

Symptom Severity:
Severity 1 - Critical
Bug Fix Policy:
View Atlassian Server bug fix policy

The version of the Application Links plugin used in Bitbucket Server and Bitbucket Data Center before version 5.16.6, from version 6.0.0 before version 6.0.6, from version 6.1.0 before version 6.1.5, from version 6.2.0 before version 6.2.2, and from version 6.3.0 before version 6.3.1 allows remote attackers to obtain information about configured application links via a missing permissions check. See https://ecosystem.atlassian.net/browse/APL-1386 for more details.

is related to

APL-1386 Information disclosure in the listEntityLinks servlet resource - CVE-2019-15011

Done

No work has yet been logged on this issue.

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Affected customers:: 0 This affects my team

Watchers:: 1 Start watching this issue

Created:: 17/Dec/2019 4:10 AM

Updated:: 31/May/2023 3:05 PM

Resolved:: 17/Dec/2019 4:13 AM

Bitbucket Data Center

Details

Description

Attachments

Issue Links

Forms

Activity

People

Dates

Backbone Issue Sync