The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from ve

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• atlassian bitbucket3.7.0 and later · before 4.14.11
• atlassian bitbucket5.0.0 and later · before 5.0.9
• atlassian bitbucket5.1.0 and later · before 5.1.8
• atlassian bitbucket5.2.0 and later · before 5.2.6
• atlassian bitbucket5.3.0 and later · before 5.3.4
• atlassian bitbucket5.4.0 and later · before 5.4.2
• atlassian bitbucket5.5.0
• atlassian bitbucket5.5.2
• atlassian bitbucket5.5.3
• atlassian bitbucket5.5.4
• atlassian bitbucket5.5.5
• atlassian bitbucket5.5.6

Versions reported by the vendor

Affected version ranges reported by the assigning authority (atlassian). Independent of NVD's CPE analysis and usually ahead of it.

• Atlassian Bitbucket Server

  • from 3.7.0 prior to 4.14.11, from 5.0.0 prior to 5.0.9, from 5.1.0 prior to 5.1.8, from 5.2.0 prior to 5.2.6, from 5.3.0 prior to 5.3.4, from 5.4.0 prior to 5.4.2, from 5.5.0 prior to 5.5.1affected

Other highest-scoring records for the same primary product.

• CVE-2022-36804Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10,KEV
  95Now
• CVE-2022-43781There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center.
  68This week
• CVE-2019-15000The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x ), from 6.0.0 before 6.0.10 (
  41Plan
• CVE-2018-5225In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before
  40Plan
• CVE-2019-3397Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 be
  37Monitor
• CVE-2019-20097Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0
  36Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.