Firetruck

CVE-2022-36804

KEV

Atlassian Bitbucket Server and Data Center Command Injection Vulnerability

View CVE record →
Vendor / Project
Atlassian
Product
Bitbucket Server and Data Center
Date added
Sep 30, 2022
Due date
Oct 21, 2022
Known ransomware use
Unknown
CWEs
CWE-78, CWE-88, CWE-158

Description

Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.

Required action

Apply updates per vendor instructions.

Notes