Read the docs
TI-2019-11186 Aliases CVE-2019-15000GHSA-vh64-mrcj-mr4j

OS command injection in Atlassian Bitbucket Server

Priority MEDIUM 53CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x ), from 6.0.0 before 6.0.10 (the fixed version for 6.0.x), from 6.1.0 before 6.1.8 (the fixed version for 6.1.x), from 6.2.0 before 6.2.6 (the fixed version for 6.2.x), from 6.3.0 before 6.3.5 (the fixed version for 6.3.x), from 6.4.0 before 6.4.3 (the fixed version for 6.4.x), and from 6.5.0 before 6.5.2 (the fixed version for 6.5.x) allows remote attackers who have permission to access a repository, if public access is enabled for a project or repository then attackers are able to exploit this issue anonymously, to read the contents of arbitrary files on the system and execute commands via injecting additional arguments into git commands.

Why it matters now

EPSS 0.07786 94th percentileScored 2026-11-07
Fix Fixed Bitbucket Server (Atlassian): 5.16.10, 6.0.10, 6.1.8 +4Bitbucket Data Center (Atlassian): 5.16.10, 6.0.10, 6.1.8 +4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianBitbucket Serverbefore 5.16.10; 6.0.0 and later; before 6.0.10; 6.1.0 and later; before 6.1.8; 6.2.0 and later; before 6.2.6; 6.3.0 and later; before 6.3.5; 6.4.0 and later; before 6.4.3; 6.5.0 and later; before 6.5.25.16.10, 6.0.10, 6.1.8, 6.2.6, 6.3.5, 6.4.3, 6.5.2Patch availableCNA
AtlassianBitbucket Data Centerbefore 5.16.10; 6.0.0 and later; before 6.0.10; 6.1.0 and later; before 6.1.8; 6.2.0 and later; before 6.2.6; 6.3.0 and later; before 6.3.5; 6.4.0 and later; before 6.4.3; 6.5.0 and later; before 6.5.25.16.10, 6.0.10, 6.1.8, 6.2.6, 6.3.5, 6.4.3, 6.5.2Patch availableCNA
  • Bitbucket Server VendorAtlassian Affected before 5.16.10; 6.0.0 and later; before 6.0.10; 6.1.0 and later; before 6.1.8; 6.2.0 and later; before 6.2.6; 6.3.0 and later; before 6.3.5; 6.4.0 and later; before 6.4.3; 6.5.0 and later; before 6.5.2 Fixed in 5.16.10, 6.0.10, 6.1.8, 6.2.6, 6.3.5, 6.4.3, 6.5.2 Patch available CNA
  • Bitbucket Data Center VendorAtlassian Affected before 5.16.10; 6.0.0 and later; before 6.0.10; 6.1.0 and later; before 6.1.8; 6.2.0 and later; before 6.2.6; 6.3.0 and later; before 6.3.5; 6.4.0 and later; before 6.4.3; 6.5.0 and later; before 6.5.2 Fixed in 5.16.10, 6.0.10, 6.1.8, 6.2.6, 6.3.5, 6.4.3, 6.5.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*5.16.0 to before 5.16.10; 6.0.0 to before 6.0.10; 6.1.0 to before 6.1.8; 6.2.0 to before 6.2.6; 6.3.0 to before 6.3.5; 6.4.0 to before 6.4.3; 6.5.0 to before 6.5.2VulnerableAtlassian
  • cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* Versions 5.16.0 to before 5.16.10; 6.0.0 to before 6.0.10; 6.1.0 to before 6.1.8; 6.2.0 to before 6.2.6; 6.3.0 to before 6.3.5; 6.4.0 to before 6.4.3; 6.5.0 to before 6.5.2 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Bitbucket Server (Atlassian) Fixed in 5.16.10, 6.0.10, 6.1.8, 6.2.6, 6.3.5, 6.4.3, 6.5.2
  • Fix · CNA Bitbucket Data Center (Atlassian) Fixed in 5.16.10, 6.0.10, 6.1.8, 6.2.6, 6.3.5, 6.4.3, 6.5.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-15000
  2. 2026-10-03 Alias added: GHSA-vh64-mrcj-mr4j

References

Advisory 1

Other 2

  • TI-2022-17043 OS command injection in Atlassian Bitbucket Server KEVCVSS 3.1HIGH 8.8
  • TI-2022-21515 Command injection in Atlassian Bitbucket Data Center CVSS 3.1CRITICAL 9.8
  • TI-2022-09598 Improper authentication in Atlassian Bamboo Server CVSS 3.1CRITICAL 9.8
  • TI-2018-03782 Link following in Atlassian Bitbucket Server CVSS 3.0CRITICAL 9.9
  • TI-2019-02555 Path traversal in Atlassian Bitbucket Data Center CVSS 3.0CRITICAL 9.1
  • TI-2022-09599 Origin validation error in Atlassian Bamboo Server CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences