CVE-2022-36804

Atlassian Bitbucket Server and Data Center Command Injection Vulnerability

Atlassian — Bitbucket Server and Data Center

Added to KEV catalog: 30 September 2022
Federal remediation due date: 21 October 2022
Weakness classification (CWE): CWE-78, CWE-88, CWE-158

CISA Description

Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.

Required action

Apply updates per vendor instructions.

Notes

https://jira.atlassian.com/browse/BSERV-13438; https://nvd.nist.gov/vuln/detail/CVE-2022-36804

View on NVD View on MITRE CVE View full CISA catalog

More Atlassian Vulnerabilities

CVE-2021-26086

Atlassian Jira Server and Data Center Path Traversal Vulnerability

CVE-2023-22527

Atlassian Confluence Data Center and Server Template Injection Vulnerability

CVE-2023-22518

Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

CVE-2023-22515

Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

CVE-2022-26138

Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services