CVE-2022-43781
At a glance Severity CRITICAL 9.8 EPSS EPSS 98.04 % · percentile 100 (2026-10-27) State PUBLISHED Published 2022-11-17 Updated 2024-10-02 Assigner atlassian NVD status Modified Description There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.
Scores Version Score Vector Scored by CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
Weaknesses (CWE)
European references
Affected configurations (NVD CPE) cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.6.19cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 7.7.0 < 7.17.12cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 7.18.0 < 7.21.6cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 7.22.0 < 8.0.5cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 8.1.0 < 8.1.5cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 8.2.0 < 8.2.4cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 8.3.0 < 8.3.3cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 8.4.0 < 8.4.2Affected products Product Versions Atlassian · Bitbucket Data Center unaffected before 7.0 ; affected before 7.17.12 ; affected before 7.21.6 ; affected before 7.6.19 ; affected before 8.0.5 ; affected before 8.1.5 Atlassian · Bitbucket Server unaffected before 7.0 ; affected before 7.17.12 ; affected before 7.21.6 ; affected before 7.6.19 ; affected before 8.0.5 ; affected before 8.1.5
References
Sources
