Bitbucket CVE-2020-14171

MEDIUM

Cleartext Transmission of Sensitive Information (CWE-319)

2020-07-09 security@atlassian.com

Atlassian Information Disclosure Bitbucket

6.5

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

1

CVE Published

Jul 09, 2020 - 18:15 nvd

MEDIUM 6.5

DescriptionNVD

Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the-Middle (MITM) attack.

AnalysisAI

Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the-Middle (MITM) attack. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-319. Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the-Middle (MITM) attack. Affected products include: Atlassian Bitbucket. Version information: version 4.9.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Bitbucket

View all

CVE-2022-43781 CRITICAL Act Now POC

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. Rated critic

CVE-2022-36804 HIGH Act Now POC

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef

CVE-2018-5225 CRITICAL Act Now

In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through

CVE-2022-26136 CRITICAL Act Now

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used

CVE-2019-15000 CRITICAL Act Now

The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x ), from 6

CVE-2019-3397 CRITICAL Act Now

Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.1

CVE-2022-26137 HIGH This Week

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Fil

CVE-2016-4320 MEDIUM This Month

Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a direct

CVE-2020-14170 MEDIUM This Month

Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the cont

CVE-2019-15005 MEDIUM This Month

The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate p

Same weakness CWE-319 – Cleartext Transmission of Sensitive Information

View all

CVE-2025-26199 CRITICAL POC

CVE-2025-32880 CRITICAL POC

CVE-2023-33730 CRITICAL POC

CVE-2019-15911 CRITICAL POC

CVE-2019-18852 CRITICAL POC

CVE-2024-25735 CRITICAL POC

CVE-2023-23914 CRITICAL POC

CVE-2024-50634 HIGH POC

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Share

CVE-2020-14171 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy