CVE-2022-43781
En bref Sévérité CRITICAL 9.8 EPSS EPSS 98.04 % · centile 100 (2026-10-27) État PUBLISHED Publiée 2022-11-17 Mise à jour 2024-10-02 Attribuée par atlassian Statut NVD Modified Description There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.
Scores Version Score Vecteur Évalué par CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
Faiblesses (CWE)
Références européennes
Configurations affectées (CPE NVD) cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.6.19cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 7.7.0 < 7.17.12cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 7.18.0 < 7.21.6cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 7.22.0 < 8.0.5cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 8.1.0 < 8.1.5cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 8.2.0 < 8.2.4cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 8.3.0 < 8.3.3cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* ≥ 8.4.0 < 8.4.2Produits affectés Produit Versions Atlassian · Bitbucket Data Center unaffected before 7.0 ; affected before 7.17.12 ; affected before 7.21.6 ; affected before 7.6.19 ; affected before 8.0.5 ; affected before 8.1.5 Atlassian · Bitbucket Server unaffected before 7.0 ; affected before 7.17.12 ; affected before 7.21.6 ; affected before 7.6.19 ; affected before 8.0.5 ; affected before 8.1.5
Références
Sources
