CVE-2024-21684

There is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center. Versions of Bitbucket DC from 8.0.0 to 8.9.12 and 8.19.0 to 8.19.1 are affected by this vulnerability. It is patched in 8.9.13 and 8.19.2. This open redirect vulnerability, with a CVSS Score of 3.1 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, allows an unauthenticated attacker to redirect a victim user upon login to Bitbucket Data Center to any arbitrary site which can be utilized for further exploitation which has low impact to confidentiality, no impact to integrity, no impact to availability, and requires user interaction. Atlassian recommends that Bitbucket Data Center customers upgrade to the version. If you are unable to do so, upgrade your instance to one of the supported fixed versions.

• CWE-601

• https://jira.atlassian.com/browse/BSERV-19454Issue Tracking, Vendor Advisory
• https://jira.atlassian.com/browse/BSERV-19454Issue Tracking, Vendor Advisory

Published

Jul 24, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21677This High severity Path Traversal vulnerability was introduc…8.8
• CVE-2024-21678This High severity Stored XSS vulnerability was introduced i…8.5
• CVE-2024-21679Rejected reason: To maintain compliance with CNA rules, we h…
• CVE-2024-2168A vulnerability was found in SourceCodester Online Tours & T…7.2
• CVE-2024-21682This High severity Injection vulnerability was introduced in…7.2
• CVE-2024-21683This High severity RCE (Remote Code Execution) vulnerability…8.8
• CVE-2024-21685This High severity Information Disclosure vulnerability was …6.5
• CVE-2024-21686This High severity Stored XSS vulnerability was introduced i…8.7
• CVE-2024-21687This High severity File Inclusion vulnerability was introduc…8.1
• CVE-2024-21688Rejected reason: To maintain compliance with CNA rules, we h…
• CVE-2024-21689This High severity RCE (Remote Code Execution) vulnerability…8
• CVE-2024-2169Implementations of UDP application protocol are vulnerable t…7.5