CVE-2017-16857

State: Published
Severity: Not scored
Published: Dec 5, 2017
Updated: Sep 17, 2024
Reserved: Nov 16, 2017

Description

It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end. This allows an attacker to merge any code into unsuspecting repositories. This affects all versions of the auto-unapprove plugin, however since the auto-unapprove plugin is not bundled with Bitbucket Server it does not affect any particular version of Bitbucket.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Auto-Unapprove Plugin (for Bitbucket Server)Atlassian	All versions prior to version 3.0.1Affected

References

https://jira.atlassian.com/browse/BSERV-10439

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.