CRITICAL🇵🇱 Wersja polska

CVE-2022-43781

CVSS 9.8v3.1pub. 2022-11-17upd. 2024-11-21

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Atlassian Bitbucket

    APP
    Atlassian
    7.0.0 – 7.6.19 (bez)7.7.0 – 7.17.12 (bez)7.18.0 – 7.21.6 (bez)7.22.0 – 8.0.5 (bez)8.1.0 – 8.1.5 (bez)8.2.0 – 8.2.4 (bez)8.3.0 – 8.3.3 (bez)8.4.0 – 8.4.2 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2022-26136CRITICAL9.8ten sam produkt

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Fil...

CVE-2019-15000CRITICAL9.8ten sam produkt

The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x...

CVE-2019-3397CRITICAL9.1ten sam produkt

Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed versi...

CVE-2018-5225CRITICAL9.9ten sam produkt

In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13....

CVE-2022-36804HIGH8.8⚠ KEVten sam produkt

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version...