Vulnerability Notification: SRJIRA-8448
A security vulnerability has been identified affecting ScriptRunner for Bitbucket Data Center and Server versions up to and including 8.60.0, 9.0.0-9.34.0, and 10.4.0-10.11.0.
This is a vulnerability with a CVSS score of 8.9, rated High. Please note there is no CVE number as this vulnerability is not related to a public CVE.
Please immediately upgrade to the latest ScriptRunner version available for your Bitbucket instance to patch this vulnerability.
What happened?
We discovered a vulnerability while performing a security review, prompted by a report submitted from a third-party researcher.
At the time of writing, we have no indication that this vulnerability has been exploited.
What do I need to do?
You must upgrade to the latest version of ScriptRunner available for your Bitbucket instance as soon as possible.
Data Center
Data Center upgrade versions are available as follows:
- ScriptRunner 10.13.0 compatible with Bitbucket 10.0.0 - 10.3.0.
- ScriptRunner 9.38.0 compatible with Bitbucket 9.0.0 - 9.6.5.
- ScriptRunner 8.63.0 compatible with Bitbucket 8.0.0 - 8.19.0.
Server
For those still running on the unsupported Server hosting, a patch has been made available:
- ScriptRunner 8.63.1 is compatible with Bitbucket Server 8.0.0 - 8.19.29.
Learn how to access the upgrade and how to update your version of ScriptRunner for Bitbucket using this guide.
If you have an Atlassian partner, you can reach out to them for assistance with this upgrade.
If you do not have an Atlassian partner, you can reach out to our support team.
What if I can't upgrade?
The recommended workaround for those who are unable to upgrade immediately is to disable ScriptRunner on your Bitbucket instance/s until you are able to upgrade.
If this solution is not workable for your setup, or you do not anticipate being able to upgrade for any reason, please reach out to our support team for further assistance.
If you have any other questions or require further support, please raise a ticket here.