CVEvulnerability

CVE-2022-43781

9.8 CRITICAL Published 2022-11-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-11-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77

Description

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.

Affected configurations

• atlassian bitbucket (>= 7.0.0 < 7.6.19) • atlassian bitbucket (>= 7.7.0 < 7.17.12) • atlassian bitbucket (>= 7.18.0 < 7.21.6) • atlassian bitbucket (>= 7.22.0 < 8.0.5) • atlassian bitbucket (>= 8.1.0 < 8.1.5) • atlassian bitbucket (>= 8.2.0 < 8.2.4) • atlassian bitbucket (>= 8.3.0 < 8.3.3) • atlassian bitbucket (>= 8.4.0 < 8.4.2)

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References