All vulnerabilities
CVE-2022-36804

Atlassian Bitbucket Server and Data Center Command Injection Vulnerability

Atlassian Bitbucket Server and Data CenterApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationExploited in the wildAdded to KEV 30 Sep 2022CISA KEV
Exploit odds (EPSS)99.2%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7.6.17Also 7.17.10, 7.21.4 and 4 moreCVE List
Federal deadline21 Oct 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

Show all 14 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 24 Aug 2022Exploit code publicMetasploit
  2. 25 Aug 2022, 05:40 UTCPublishedCVE List
  3. 30 Sep 2022Added to CISA KEVCISA KEV

Public exploit code and templates 3

  • Exploit moduleBitbucket Git Command Injection 24 Aug 2022Metasploit
  • Webapps exploitBitbucket v7.0.0 - RCE 23 Mar 2023Exploit-DB
  • Scanner templateAtlassian Bitbucket - Remote Command InjectionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.

Text from CVE List

Affected versions 28

  • Bitbucket Serveraffected: 7.0.0 before unspecifiedCVE List
  • Bitbucket Serveraffected: unspecified before 7.6.17CVE List
  • Bitbucket Serveraffected: 7.7.0 before unspecifiedCVE List
  • Bitbucket Serveraffected: unspecified before 7.17.10CVE List
  • Bitbucket Serveraffected: 7.18.0 before unspecifiedCVE List
  • Bitbucket Serveraffected: unspecified before 7.21.4CVE List
  • Bitbucket Serveraffected: 8.0.0 before unspecifiedCVE List
  • Bitbucket Serveraffected: unspecified before 8.0.3CVE List
  • Bitbucket Serveraffected: 8.1.0 before unspecifiedCVE List
  • Bitbucket Serveraffected: unspecified before 8.1.3CVE List
  • Bitbucket Serveraffected: 8.2.0 before unspecifiedCVE List
  • Bitbucket Serveraffected: unspecified before 8.2.2CVE List
  • Bitbucket Serveraffected: 8.3.0 before unspecifiedCVE List
  • Bitbucket Serveraffected: unspecified before 8.3.1CVE List
  • Bitbucket Data Centeraffected: 7.0.0 before unspecifiedCVE List
  • Bitbucket Data Centeraffected: unspecified before 7.6.17CVE List
  • Bitbucket Data Centeraffected: 7.7.0 before unspecifiedCVE List
  • Bitbucket Data Centeraffected: unspecified before 7.17.10CVE List
  • Bitbucket Data Centeraffected: 7.18.0 before unspecifiedCVE List
  • Bitbucket Data Centeraffected: unspecified before 7.21.4CVE List
  • Bitbucket Data Centeraffected: 8.0.0 before unspecifiedCVE List
  • Bitbucket Data Centeraffected: unspecified before 8.0.3CVE List
  • Bitbucket Data Centeraffected: 8.1.0 before unspecifiedCVE List
  • Bitbucket Data Centeraffected: unspecified before 8.1.3CVE List
  • Bitbucket Data Centeraffected: 8.2.0 before unspecifiedCVE List
  • Bitbucket Data Centeraffected: unspecified before 8.2.2CVE List
  • Bitbucket Data Centeraffected: 8.3.0 before unspecifiedCVE List
  • Bitbucket Data Centeraffected: unspecified before 8.3.1CVE List

References 3