CVE-2017-18087
Quick assessment
Affected
Atlassian Bitbucket Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Atlassian Bitbucket Server是澳大利亚Atlassian公司的一款Git代码托管解决方案。该方案能够管理并审查代码，具有差异视图、JIRA集成和构建集成等功能。 Atlassian Bitbucket Server中的download commit资源存在提权漏洞。远程攻击者可借助‘at’参数利用该漏洞向磁盘中写入文件，执行代码。以下版本受到影响：Atlassian Bitbucket Server 5.1.0版本至5.1.7版本（不包括5.1.7版本），5.2.0版本至5.2.5
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2017-18087
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version 5.4.0 before version 5.4.1 allows remote attackers to write files to disk potentially allowing them to gain code execution, exploit CVE-2017-1000117 if a vulnerable version of git is in use, and or determine if an internal service exists via an argument injection vulnerability in the at parameter.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Atlassian Bitbucket Server 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Atlassian Bitbucket Server是澳大利亚Atlassian公司的一款Git代码托管解决方案。该方案能够管理并审查代码，具有差异视图、JIRA集成和构建集成等功能。 Atlassian Bitbucket Server中的download commit资源存在提权漏洞。远程攻击者可借助‘at’参数利用该漏洞向磁盘中写入文件，执行代码。以下版本受到影响：Atlassian Bitbucket Server 5.1.0版本至5.1.7版本（不包括5.1.7版本），5.2.0版本至5.2.5
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Atlassian | Bitbucket Server | from 5.1.0 prior to 5.1.7 | - |
|
II. Public POCs for CVE-2017-18087
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2017-18087
请登录查看更多情报信息。
Vendor Advisories for CVE-2017-18087 (1)
Other References for CVE-2017-18087 (1)
-
https://jira.atlassian.com/browse/BSERV-10593 x_refsource_CONFIRM