CVE-2019-15012

Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint, if the user has Bitbucket Server or Bitbucket Data Center running, and has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance.

• CWE-269

• https://jira.atlassian.com/browse/BSERV-12100Issue Tracking, Vendor Advisory
• https://jira.atlassian.com/browse/BSERV-12100Issue Tracking, Vendor Advisory

Published

Jan 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15007The review resource in Atlassian Fisheye and Crucible before…4.8
• CVE-2019-15008The /plugins/servlet/branchreview resource in Atlassian Fish…6.1
• CVE-2019-15009The /json/profile/removeStarAjax.do resource in Atlassian Fi…4.3
• CVE-2019-1501Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15010Bitbucket Server and Bitbucket Data Center versions starting…8.8
• CVE-2019-15011The ListEntityLinksServlet resource in Application Links bef…4.3
• CVE-2019-15013The WorkflowResource class removeStatus method in Jira befor…4.3
• CVE-2019-15014A command injection vulnerability exists in the Zingbox Insp…8.8
• CVE-2019-15015In the Zingbox Inspector, versions 1.294 and earlier, hardco…8.4
• CVE-2019-15016An SQL injection vulnerability exists in the management inte…8.8
• CVE-2019-15017The SSH service is enabled on the Zingbox Inspector versions…8.4
• CVE-2019-15018A security vulnerability exists in the Zingbox Inspector ver…7.5