Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2022-36804

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10,

Affects Atlassian Bitbucket Server and Data Center 7.0.0 through 8.3.0 inclusive, across several release branches. Fixed in 7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.3, 8.2.2 and 8.3.1.

Published
Last modified
published
Listed in CISA KEV
Actively exploited
Fix
Fixed in 7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.3, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

Atlassian Bitbucket Server and Data Center are affected by this vulnerability. An attacker with read access to a public or private Bitbucket repository could send a specially crafted HTTP request to certain API endpoints and execute arbitrary code on the server.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Atlassian Bitbucket Server

    From 7.0.0 · fixed in unspecified; From unspecified · fixed in 7.6.17; From 7.7.0 · fixed in unspecified; From unspecified · fixed in 7.17.10; From 7.18.0 · fixed in unspecified; From unspecified · fixed in 7.21.4; From 8.0.0 · fixed in unspecified; From unspecified · fixed in 8.0.3; From 8.1.0 · fixed in unspecified; From unspecified · fixed in 8.1.3; From 8.2.0 · fixed in unspecified; From unspecified · fixed in 8.2.2; From 8.3.0 · fixed in unspecified; From unspecified · fixed in 8.3.1

  • Atlassian Bitbucket Data Center

    From 7.0.0 · fixed in unspecified; From unspecified · fixed in 7.6.17; From 7.7.0 · fixed in unspecified; From unspecified · fixed in 7.17.10; From 7.18.0 · fixed in unspecified; From unspecified · fixed in 7.21.4; From 8.0.0 · fixed in unspecified; From unspecified · fixed in 8.0.3; From 8.1.0 · fixed in unspecified; From unspecified · fixed in 8.1.3; From 8.2.0 · fixed in unspecified; From unspecified · fixed in 8.2.2; From 8.3.0 · fixed in unspecified; From unspecified · fixed in 8.3.1

References 3

jira.atlassian.com

packetstormsecurity.com

FAQ

Questions about CVE-2022-36804

What does this mean?

Multiple API endpoints in Bitbucket Server and Data Center can be abused with a malicious HTTP request, which lets an attacker execute arbitrary code on the Bitbucket server.Source: jira.atlassian.com

Am I affected, and how do I check?

Affected versions are 7.0.0 up to 7.6.17, 7.7.0 up to 7.17.10, 7.18.0 up to 7.21.4, 8.0.0 up to 8.0.3, 8.1.0 up to 8.1.3, 8.2.0 up to 8.2.2, and 8.3.0 up to 8.3.1, for both Bitbucket Server and Bitbucket Data Center. To check, compare the installed version against these ranges.Source: jira.atlassian.com

What should I do about it?

Upgrade to the fixed release for your branch: 7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.3, 8.2.2 or 8.3.1. The advisory cites 7.6.17 (LTS) or newer as the fix for the 7.x line.Source: jira.atlassian.com

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-09-30, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data