CVE-2022-36804

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

https://jira.atlassian.com/browse/BSERV-13438; https://nvd.nist.gov/vuln/detail/CVE-2022-36804

Remediation deadline: October 21, 2022

Description

Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.

Timeline

Published:September 30th, 2022 12:00 AM

Last modified:September 30th, 2022 12:00 AM

Added to KEV:September 30th, 2022

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

Atlassian

Products

Bitbucket Server and Data Center

Weaknesses (CWE)

CWE-78 CWE-88 CWE-158

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute