CVE-2022-43781
Atlassian Bitbucket Data Center
CRITICAL 9.8
En bref
- Source
- NVD
- EPSS
- EPSS 98.04 % · centile 100 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- atlassian
- Statut NVD
- Modified
Description
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.
Faiblesses (CWE)
- CWE-77 — Injection de commande
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2022-46751
- GCVE · GCVE-0-2022-43781
Configurations affectées (CPE NVD)
cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 7.0.0 < 7.6.19cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 7.7.0 < 7.17.12cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 7.18.0 < 7.21.6cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 7.22.0 < 8.0.5cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 8.1.0 < 8.1.5cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 8.2.0 < 8.2.4cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 8.3.0 < 8.3.3cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*≥ 8.4.0 < 8.4.2
Produits affectés
| Produit | Versions |
|---|---|
| Atlassian · Bitbucket Data Center | unaffected before 7.0 ; affected before 7.17.12 ; affected before 7.21.6 ; affected before 7.6.19 ; affected before 8.0.5 ; affected before 8.1.5 |
| Atlassian · Bitbucket Server | unaffected before 7.0 ; affected before 7.17.12 ; affected before 7.21.6 ; affected before 7.6.19 ; affected before 8.0.5 ; affected before 8.1.5 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |