CVE-2022-36804

high-risk
Published 2022-08-25

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Do I need to act?

!
94.4% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
1 public exploit available
51040
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Atlassian

References (7)

Exploit http://packetstormsecurity.com/files/168470/Bitbucket-Git-Command-Injection.html
Exploit http://packetstormsecurity.com/files/171453/Bitbucket-7.0.0-Remote-Command-Execu...
Issue Tracking https://jira.atlassian.com/browse/BSERV-13438
Exploit http://packetstormsecurity.com/files/168470/Bitbucket-Git-Command-Injection.html
Exploit http://packetstormsecurity.com/files/171453/Bitbucket-7.0.0-Remote-Command-Execu...
Issue Tracking https://jira.atlassian.com/browse/BSERV-13438
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-...
64
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 27/34 · High
Exposure 7/34 · Low