NetSight
IP …
high8.8Known exploitedPublic exploit code

CVE-2022-36804

Atlassian Bitbucket Server and Data Center Command Injection Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-09-30. Federal due date: 2022-10-21.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Affected products

VendorProductAffected versions
AtlassianBitbucket
from 7.0.0 before 7.6.17
from 7.7.0 before 7.17.10
from 7.18.0 before 7.21.4
from 8.0.0 before 8.0.3
from 8.1.0 before 8.1.3
from 8.2.0 before 8.2.2

Weakness classification

CWE-78CWE-88

References