CVE-2022-36804 — Atlassian Bitbucket Server and Data Center Command Injection Vulnerability

provenance: imported · CVE: CVE-2022-36804

CVE-2022-36804: Atlassian Bitbucket Server and Data Center Command Injection Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	Atlassian
Product	Bitbucket Server and Data Center
Date added	2022-09-30
Due date	2022-10-21
Ransomware campaign use	Unknown

Description

Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://jira.atlassian.com/browse/BSERV-13438; https://nvd.nist.gov/vuln/detail/CVE-2022-36804

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-36804
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog