Log in Start free

Actively exploited · Published Aug 25, 2022 · Assigned by atlassian

CVE-2022-36804

High 8.8 Exploited

In plain English

A high-severity OS command injection in Bitbucket Data Center from Atlassian. Attackers are actively exploiting it in the wild (listed by CISA on September 30, 2022). The chance it is exploited in the next 30 days is estimated at 99.1% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)99.1%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Sep 30, 2022
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Oct 21, 2022.

Official description

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Affected products (as reported)

VendorProductVersions
Atlassian Bitbucket Server 7.0.0 – before unspecifiedunspecified – before 7.6.177.7.0 – before unspecifiedunspecified – before 7.17.107.18.0 – before unspecifiedunspecified – before 7.21.48.0.0 – before unspecifiedunspecified – before 8.0.3
Atlassian Bitbucket Data Center 7.0.0 – before unspecifiedunspecified – before 7.6.177.7.0 – before unspecifiedunspecified – before 7.17.107.18.0 – before unspecifiedunspecified – before 7.21.48.0.0 – before unspecifiedunspecified – before 8.0.3

Weakness: CWE-78, CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References