CVE-2017-16857

It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end

published December 5, 2017

CVSS
—
EPSS
1%
Percentile
47.5
In the wild
Unconfirmed
What it is

It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end. This allows an attacker to merge any code into unsuspecting repositories. This affects all versions of the auto-unapprove plugin, however since the auto-unapprove plugin is not bundled with Bitbucket Server it does not affect any particular version of Bitbucket.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00591 · 47.5th percentile
Published
2017-12-05T16:00Z
EPSS history
Timeline
  • 05 DEC 16:00Z
    It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end
    cvelistv5