VULNERABILITY INTELLIGENCE

CVE-2017-16857

CVSS score8.5 HIGH
EPSS probability0.59%
CISA KEVNot currently listed
Published2017-12-05
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Description

It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end. This allows an attacker to merge any code into unsuspecting repositories. This affects all versions of the auto-unapprove plugin, however since the auto-unapprove plugin is not bundled with Bitbucket Server it does not affect any particular version of Bitbucket.

Weakness classification

  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Primary references