Uploaded image for project: 'Bitbucket Data Center'
  1. Bitbucket Data Center
  2. BSERV-12753

Privilege Escalation Vulnerability in Atlassian Bitbucket on Windows - CVE-2020-36233

XMLWordPrintable

    • Severity 1 - Critical
    • 7.8
    • CVE-2020-36233
    • PrivEsc (Priviledge Escalation)

      Issue Summary

      Atlassian Bitbucket on Windows fails to properly set ACLs on its installation directory. Because Bitbucket installs High-privileged services, this allows for multiple privilege escalation vulnerability possibilities.

      Affected Versions

      The following versions are only affected on Windows:

      • All versions < 6.10.9
      • 7.x < 7.6.4
      • 7.7.x
      • 7.8.x
      • 7.9.x
      • 7.10.0

      Fixed Versions

      • 6.10.9 (Long Term Support release)
      • 7.6.4 (Long Term Support release)
      • 7.10.1

       

            [BSERV-12753] Privilege Escalation Vulnerability in Atlassian Bitbucket on Windows - CVE-2020-36233

            Brian Adeloye (Inactive) added a comment -

            This is an independent assessment and you should evaluate its applicability to your own IT environment.

            CVSS v3 score: 7.8 => High severity

            Exploitability Metrics

            Attack Vector Local
            Attack Complexity Low
            Privileges Required Low
            User Interaction None

            Scope Metric

            Scope Unchanged

            Impact Metrics

            Confidentiality High
            Integrity High
            Availability High

            https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

            Brian Adeloye (Inactive) added a comment - This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 7.8 => High severity Exploitability Metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Metric Scope Unchanged Impact Metrics Confidentiality High Integrity High Availability High https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

              Unassigned Unassigned
              ckochovski@atlassian.com Christopher Kochovski
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: