Advisory severityMedium4.3Atlassian

Medium [CVE-2024-21684] Bitbucket: There is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center.

This medium-severity Atlassian advisory covers CVE-2024-21684; related products: Bitbucket.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2024-21684 Source published Jul 25, 2024Source updated Jun 17, 2026

VulniPulse record published Jul 25, 2024Record updated Jun 17, 2026

CVE-2024-21684

Monitor future Atlassian CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

There is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center. Versions of Bitbucket DC from 8.0.0 to 8.9.12 and 8.19.0 to 8.19.1 are affected by this vulnerability.

It is patched in 8.9.13 and 8.19.2.

This open redirect vulnerability, with a CVSS Score of 3.1 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, allows an unauthenticated attacker to redirect a victim user upon login to Bitbucket Data Center to any arbitrary site which can be utilized for further exploitation which has low impact to confidentiality, no impact to integrity, no impact to availability, and requires user interaction.

Atlassian recommends that Bitbucket Data Center customers upgrade to the version. If you are unable to do so, upgrade your instance to one of the supported fixed versions.

Affected versions

8.0.0
8.19.0

Official advisory · high-confidence parse· fetched 3 months ago·verify at source

Fixed versions

8.9.13
8.19.2

Official advisory · high-confidence parse· fetched 3 months ago·verify at source

Mitigation

Upgrade to a fixed release: 8.9.13, 8.19.2. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 3 months ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.