CVE-2019-20097

mediumpriority · track · 36EPSS 0.025 · 84 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

2.48% (84th) EPSS

CVSS 6.5 · medium

Is it mine?

55 products

Check your exposure

Who says so?

2 sources

cnnvd · enisa_euvd

EPSS · scored 2026-10-27

Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the post-receive hook. A remote attacker with permission to clone and push files to a repository on the victim's Bitbucket Server or Bitbucket Data Center instance, can exploit this vulnerability to execute arbitrary commands on the Bitbucket Server or Bitbucket Data Center systems, using a file with specially crafted content.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–8.8

v2.06.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 8 · impact 6.4

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-918USLLM-inferredCWE-98USLLM-inferred

affected products (55)

Products and version ranges known to be affected.

Atlassian Bitbucket Data Center1.0 → unspecifiedenisa_euvdEU
Atlassian Bitbucket Data Center6.0 → unspecifiedenisa_euvdEU
Atlassian Bitbucket Data Center6.1.0 → unspecifiedenisa_euvdEU
Atlassian Bitbucket Data Center6.2.0 → unspecifiedenisa_euvdEU
Atlassian Bitbucket Data Center6.3.0 → unspecifiedenisa_euvdEU
Atlassian Bitbucket Data Center6.4.0 → unspecifiedenisa_euvdEU
Atlassian Bitbucket Data Center6.5.0 → unspecifiedenisa_euvdEU
Atlassian Bitbucket Data Center6.6.0 → unspecifiedenisa_euvdEU
Atlassian Bitbucket Data Center6.7.0 → unspecifiedenisa_euvdEU
Atlassian Bitbucket Data Center6.8.0 → unspecifiedenisa_euvdEU
Atlassian Bitbucket Data Center6.9.0 → unspecifiedenisa_euvdEU
Atlassian Bitbucket Data Centerunspecified → 5.16.11enisa_euvdEU
Atlassian Bitbucket Data Centerunspecified → 6.0.11enisa_euvdEU
Atlassian Bitbucket Data Centerunspecified → 6.1.9enisa_euvdEU
Atlassian Bitbucket Data Centerunspecified → 6.2.7enisa_euvdEU
Atlassian Bitbucket Data Centerunspecified → 6.3.6enisa_euvdEU
Atlassian Bitbucket Data Centerunspecified → 6.4.4enisa_euvdEU
Atlassian Bitbucket Data Centerunspecified → 6.5.3enisa_euvdEU
Atlassian Bitbucket Data Centerunspecified → 6.6.3enisa_euvdEU
Atlassian Bitbucket Data Centerunspecified → 6.7.3enisa_euvdEU

showing 20 of 55

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd NVD CVE.org MITRE

published 2020-01-15modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

https://jira.atlassian.com/browse/BSERV-12099 cnnvd
https://nvd.nist.gov/vuln/detail/CVE-2019-20097 cnnvd
https://jira.atlassian.com/browse/BSERV-12099 enisa_euvd
https://jira.atlassian.com/browse/BSERV-12099Issue TrackingPatchVendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan