CVE-2017-18088: Various plugin servlet resources in Atlassian Bitbucket Server before version 5.3.7 (the fixed version for...

Security readout for executives and security teams

This issue lets an attacker frame certain Atlassian Bitbucket Server plugin pages in another site. A victim could be tricked into clicking hidden or misleading Bitbucket UI. The sources identify fixed Bitbucket Server versions but do not provide CVSS severity, exploit details, or evidence of active exploitation. Exposure is likely limited to organizations running affected Atlassian Bitbucket Server versions, especially where authenticated users can reach the vulnerable plugin resources from browsers. The source bundle does not identify Bitbucket Cloud, Data Center, or other Atlassian products as affected. Treat this as a routine but real security maintenance item for Bitbucket Server. It is not supported as actively exploited in the provided sources, but Bitbucket often protects source code and engineering workflows, so affected versions should be upgraded during the next controlled patch window. Mitigation focus: Upgrade Bitbucket Server 5.3.x to 5.3.7 or later.; Upgrade 5.4.x to 5.4.6 or later.; Upgrade 5.5.x to 5.5.6 or later..

Prepared

Jun 7, 2026, 14:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.