Atlassian Bitbucket Data Center
At a glance
- Source
- NVD
- EPSS
- EPSS 98.04 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- atlassian
- NVD status
- Modified
Description
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.
Weaknesses (CWE)
- CWE-77 — Improper Neutralization of Special Elements used in a Command
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2022-46751
- GCVE · GCVE-0-2022-43781
Affected configurations (NVD CPE)
cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 7.0.0 < 7.6.19cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 7.7.0 < 7.17.12cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 7.18.0 < 7.21.6cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 7.22.0 < 8.0.5cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 8.1.0 < 8.1.5cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 8.2.0 < 8.2.4cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 8.3.0 < 8.3.3cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 8.4.0 < 8.4.2
Affected products
| Product | Versions |
|---|---|
| Atlassian · Bitbucket Data Center | unaffected before 7.0 ; affected before 7.17.12 ; affected before 7.21.6 ; affected before 7.6.19 ; affected before 8.0.5 ; affected before 8.1.5 |
| Atlassian · Bitbucket Server | unaffected before 7.0 ; affected before 7.17.12 ; affected before 7.21.6 ; affected before 7.6.19 ; affected before 8.0.5 ; affected before 8.1.5 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |