Vulnerability · Published Nov 17, 2022 · Assigned by atlassian
CVE-2022-43781
Critical 9.8
In plain English
A critical-severity command injection in Bitbucket Data Center from Atlassian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 98.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Official description
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Bitbucket Data Center | before 7.17.12before 7.21.6before 7.6.19before 8.0.5before 8.1.5before 8.2.4before 8.3.3 |
| Atlassian | Bitbucket Server | before 7.17.12before 7.21.6before 7.6.19before 8.0.5before 8.1.5before 8.2.4before 8.3.3 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H