CVE-2020-36233

Published: Feb 18, 2021Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.

Affected (3)

Products: Atlassian: Bitbucket

1 product

Configuration A

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atlassian Bitbucket	Before 6.10.9
Atlassian Bitbucket	From 7.0.0 to 7.6.4
Atlassian Bitbucket	From 7.7.0 to 7.10.1

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (4)

https://jira.atlassian.com/browse/BSERV-12753

Source: security@atlassian.com

Issue TrackingVendor Advisory

https://www.kb.cert.org/vuls/id/240785

Source: security@atlassian.com

Third Party AdvisoryUS Government Resource

https://jira.atlassian.com/browse/BSERV-12753

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://www.kb.cert.org/vuls/id/240785

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.