Vulnerability details
CVE-2022-43781
Atlassian Bitbucket Data CenterAtlassian Bitbucket ServerAtlassian bitbucket
CVSS 3.1
9.8Critical
Official description
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.8Critical | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Atlassian | Bitbucket Data Center | before 7.17.12 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Data Center | before 7.21.6 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Data Center | before 7.6.19 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Data Center | before 8.0.5 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Data Center | before 8.1.5 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Data Center | before 8.2.4 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Data Center | before 8.3.3 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Data Center | before 8.4.2 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Data Center | before 8.5.0 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Server | before 7.17.12 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Server | before 7.21.6 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Server | before 7.6.19 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Server | before 8.0.5 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Server | before 8.1.5 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Server | before 8.2.4 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Server | before 8.3.3 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Server | before 8.4.2 | CVEProject cvelistV5 (CNA) |
| Atlassian | Bitbucket Server | before 8.5.0 | CVEProject cvelistV5 (CNA) |
| Atlassian | bitbucket | 7.0.0 ≤ v < 7.6.19 | CISA ADP / Vulnrichment |
| Atlassian | bitbucket | 7.18.0 ≤ v < 7.21.6 | CISA ADP / Vulnrichment |
| Atlassian | bitbucket | 7.22.0 ≤ v < 8.0.5 | CISA ADP / Vulnrichment |
| Atlassian | bitbucket | 7.7.0 ≤ v < 7.17.12 | CISA ADP / Vulnrichment |
| Atlassian | bitbucket | 8.1.0 ≤ v < 8.1.5 | CISA ADP / Vulnrichment |
| Atlassian | bitbucket | 8.2.0 ≤ v < 8.2.4 | CISA ADP / Vulnrichment |
| Atlassian | bitbucket | 8.3.0 ≤ v < 8.3.3 | CISA ADP / Vulnrichment |
| Atlassian | bitbucket | 8.4.0 ≤ v < 8.4.2 | CISA ADP / Vulnrichment |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2022-11-17
- Last updated
- 2024-10-02
- State
- Published
- Assigner (CNA)
- atlassian
- Kolun priority
- 50 · Medium
Exploit prediction (EPSS)
98.03%
Probability of exploitation in 30 days
99.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')