How severe is CVE-2024-21684?

CVE-2024-21684 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-21684 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-21684?

CVE-2024-21684 affects Atlassian Bitbucket Data Center. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-21684?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-21684 have an EU (EUVD) identifier?

Yes. CVE-2024-21684 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-19300.

When was CVE-2024-21684 published?

CVE-2024-21684 was published on 2024-07-24 and last updated on 2026-06-17.

CVE-2024-21684

CVE-2024-21684 is a medium-severity vulnerability in Atlassian Bitbucket Data Center with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-601.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 0% (16th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-19300
Weakness: CWE-601
Affected product: Atlassian Bitbucket Data Center
Published: 2024-07-24
Last modified: 2026-06-17

Description

There is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center. Versions of Bitbucket DC from 8.0.0 to 8.9.12 and 8.19.0 to 8.19.1 are affected by this vulnerability. It is patched in 8.9.13 and 8.19.2. This open redirect vulnerability, with a CVSS Score of 3.1 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, allows an unauthenticated attacker to redirect a victim user upon login to Bitbucket Data Center to any arbitrary site which can be utilized for further exploitation which has low impact to confidentiality, no impact to integrity, no impact to availability, and requires user interaction. Atlassian recommends that Bitbucket Data Center customers upgrade to the version. If you are unable to do so, upgrade your instance to one of the supported fixed versions.

Frequently asked questions

What is CVE-2024-21684?: There is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center. Versions of Bitbucket DC from 8.0.0 to 8.9.12 and 8.19.0 to 8.19.1 are affected by this vulnerability. It is patched in 8.9.13 and 8.19.2. This open redirect vulnerability, with a CVSS Score of 3.1 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, allows an unauthenticated attacker to redirect a victim user upon login to Bitbucket Data Center to any arbitrary site which can be utilized for further exploitation which has low impact to confidentiality, no impact to integrity, no impact to availability, and requires user interaction. Atlassian recommends that Bitbucket Data Center customers upgrade to the version. If you are unable to do so, upgrade your instance to one of the supported fixed versions.
How severe is CVE-2024-21684?: CVE-2024-21684 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-21684 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-21684?: CVE-2024-21684 affects Atlassian Bitbucket Data Center. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-21684?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-21684 have an EU (EUVD) identifier?: Yes. CVE-2024-21684 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-19300.
When was CVE-2024-21684 published?: CVE-2024-21684 was published on 2024-07-24 and last updated on 2026-06-17.

References

https://jira.atlassian.com/browse/BSERV-19454

Affected products (1)

cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*

More vulnerabilities in Atlassian Bitbucket Data Center

CVE-2022-26133 — Critical (CVSS 9.8): SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and…
CVE-2023-22513 — High (CVSS 8.8): This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center…

All CVEs affecting Atlassian Bitbucket Data Center →

Other CWE-601 (Open Redirect) vulnerabilities

CVE-2018-3774 — Critical (CVSS 10.0): Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open…
CVE-2019-25282 — Critical (CVSS 9.8): V-SOL GPON/EPON OLT Platform v2.03 contains an open redirect vulnerability in the script that allows attackers to…
CVE-2020-36912 — Critical (CVSS 9.8): Plexus anblick Digital Signage Management 3.1.13 contains an open redirect vulnerability in the 'PantallaLogin' script…
CVE-2025-43526 — Critical (CVSS 9.8): This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac…
CVE-2025-55031 — Critical (CVSS 9.8): Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An…
CVE-2024-22891 — Critical (CVSS 9.8): Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.

Browse all CWE-601 (Open Redirect) vulnerabilities →