⚠ Actively exploited
Added to CISA KEV on 2022-09-30. Federal agencies required to patch by 2022-10-21. Required action: Apply updates per vendor instructions..

CVE-2022-36804

CWE-78 — OS Command InjectionCWE-88CWE-158CWE-77 — Command Injection8 documents8 sources
Severity
8.8HIGH
EPSS
94.4%
top 0.02%
CISA KEV
KEV
Added 2022-09-30
Due 2022-10-21
Exploit
Exploited in wild
Active exploitation observed
Affected products
3
Atlassian Bitbucket Data CenterAtlassian Bitbucket ServerAtlassian Bitbucket
Timeline
PublishedAug 25
KEV addedSep 30
KEV dueOct 21
Latest updateMar 23
CISA Required Action: Apply updates per vendor instructions.

Description

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5atlassian/bitbucket_data_center7.0.0 — unspecified+13
▶CVEListV5atlassian/bitbucket_server7.0.0 — unspecified+13
▶NVDatlassian/bitbucket7.0.0 — 7.6.17+6

Patches

Patch: jira.atlassian.com ↗Patch: jira.atlassian.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-vcm2-j8f4-m7fj: Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7↗2022-08-26
▶
CVEList
CVE-2022-36804: Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7↗2022-08-25
▶
VulnCheck
Atlassian Bitbucket Server and Data Center Command Injection Vulnerability↗2022
▶

💥Exploits & PoCs

2
Exploit-DB
Bitbucket v7.0.0 - RCE↗2023-03-23
▶
Nuclei
Atlassian Bitbucket - Remote Command Injection
▶

🔍Detection Rules

1
Suricata
ET EXPLOIT Atlassian Bitbucket CVE-2022-36804 Exploit Attempt↗2022-09-22
▶

📋Vendor Advisories

1
CISA
Atlassian Bitbucket Server and Data Center Command Injection Vulnerability↗2022-09-30
▶