Skip to content
OpenAdvisories
High WID-SEC-2024-1207 2 CVEs

Atlassian Bitbucket: Mehrere Schwachstellen

Published May 21, 2024 · Updated May 21, 2024 · de-DE

Vendor: Atlassian Product: Bitbucket Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Atlassian Bitbucket ausnutzen, um die Vertraulichkeit und Integrität zu gefährden.

Product

Bitbucket ist ein Git-Server zur Sourcecode-Versionskontrolle.

Vulnerabilities 2

  • High 8.2
    CVE-2024-22257

    Erroneous authentication pass in Spring Security

    In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the Au…

    org.springframework.security:spring-security-core Maven
  • High 8.1
    CVE-2024-22262 Public exploit

    CVE-2024-22262: Spring Framework URL Parsing with Host Validation

    Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  a…

    Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven

Revision history

  1. #1

    Initiale Fassung

References