Atlassian Bitbucket Unauthenticated Broken Access Control (CVE-2019-15005)

Critical Vulnerability Information Vulnerability ID: usd-2019-0016 CVE ID: CVE-2019-15005 Affected Product: Bitbucket Affected Versions: < v6.6 Vulnerability Type: Broken Access Control Security Risk: High Vendor URL: https://www.atlassian.com/ Vendor Status: Fixed Description Access control, sometimes referred to as authorization, is how web applications grant certain users access to content and functionality while denying it to others. These checks are performed after authentication and manage which "authorized" users are permitted to perform specific actions. While access control may sound like a simple issue, it is notoriously difficult to implement correctly. The access control model of a web application is closely tied to the content and functionality provided by the site. Additionally, users may be divided into multiple groups or roles with different capabilities or permissions. Proof of Concept (PoC) At the endpoint , an administrator can create a task for periodically scanning log files. Unauthorized users cannot access the GUI for configuring such tasks. However, unauthorized users can successfully send requests to create scanning tasks. Specifically, they can specify an email address to which the results will be sent. Remediation Recommendation Protect endpoints that provide sensitive functionality and enforce appropriate access controls. Timeline 2019-03-28 Vulnerability securely submitted to security@atlassian.com 2019-08-27 Atlassian released Bitbucket 6.6.0, fixing the vulnerability 2019-10-21 First published Credit These security vulnerabilities were discovered by Tobias Neitzel and Julian Frey of usd AG.

Goal Reached Thanks to every supporter — we hit 100%!

Atlassian Bitbucket Unauthenticated Broken Access Control (CVE-2019-15005)

More from this source