HackerFeeds
All CVEs

CVE-2022-36804

HIGH8.8
CISA KEV

Published 2022-08-25 · Updated 2026-06-17 · Source security@atlassian.com

Summary

CVE-2022-36804 is a high-severity (CVSS 8.8) vulnerability in Atlassian Bitbucket Server and Data Center. CISA added it to the Known Exploited Vulnerabilities catalog on September 30, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by October 21, 2022. CISA does not currently list it as used in ransomware campaigns. Atlassian has 14 vulnerabilities in the KEV catalog, 8 of them linked to ransomware.

All 14 known-exploited Atlassian vulnerabilities →

Description

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-78CWE-88CWE-78CWE-88

CISA Known-Exploited Vulnerability

Product: Atlassian — Bitbucket Server and Data Center

Name: Atlassian Bitbucket Server and Data Center Command Injection Vulnerability

Date added: 2022-09-30 · Due: 2022-10-21

Required action: Apply updates per vendor instructions.

References

View on NVD