QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2017-16857

Back to search

CVE-2017-16857

Published: Dec 5, 2017

Modified: Sep 17, 2024

PUBLISHED

Description

It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end. This allows an attacker to merge any code into unsuspecting repositories. This affects all versions of the auto-unapprove plugin, however since the auto-unapprove plugin is not bundled with Bitbucket Server it does not affect any particular version of Bitbucket.

VendorProductVersions

Atlassian

Auto-Unapprove Plugin (for Bitbucket Server)

affected
All versions prior to version 3.0.1

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now