| Package | Affected versions | Patched versions |
|---|---|---|
| bitbucket | = 5.5.0= 5.5.2= 5.5.3= 5.5.4= 5.5.5= 5.5.6≥ 3.7.0, < 4.14.11≥ 5.0.0, < 5.0.9≥ 5.1.0, < 5.1.8≥ 5.2.0, < 5.2.6≥ 5.3.0, < 5.3.4≥ 5.4.0, < 5.4.2 | 4.14.115.0.95.1.85.2.65.3.45.4.2 |
The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from version 5.0.0 before 5.0.9 (the fixed version for 5.0.x), from version 5.1.0 before 5.1.8 (the fixed version for 5.1.x), from version 5.2.0 before 5.2.6 (the fixed version for 5.2.x), from version 5.3.0 before 5.3.4 (the fixed version for 5.3.x), from version 5.4.0 before 5.4.2 (the fixed version for 5.4.x), from version 5.5.0 before 5.5.1 (the fixed version for 5.5.x) and before 5.6.0 allows remote attackers to read arbitrary files via a path traversal vulnerability through the name of a git tag.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free