CVE-2017-16857
High
Description
It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end. This allows an attacker to merge any code into unsuspecting repositories. This affects all versions of the auto-unapprove plugin, however since the auto-unapprove plugin is not bundled with Bitbucket Server it does not affect any particular version of Bitbucket.
SeverityHigh
CVSS8.5
Exploit probability—
Product
Atlassian Bitbucket Auto Unapprove Plugin
PublishedDec 5, 2017
First seenDec 5, 2017
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian bitbucket_auto_unapprove_plugin | 1.0.0, 1.1.0, 1.2.0, 2.0.1, 2.0.2, 2.0.4, 2.1.1, 2.1.3, 2.2.0, 3.0.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.