CVE-2022-43781
Critical
Description
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Atlassian Bitbucket
PublishedNov 17, 2022
First seenNov 17, 2022
Weakness typeCWE-77Command injection
How to fix
Update
- atlassian bitbucket7.6.19, 7.17.12, 7.21.6, 8.0.5, 8.1.5, 8.2.4, 8.3.3, 8.4.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian bitbucket | 7.0.0 ≤ v < 7.6.19, 7.7.0 ≤ v < 7.17.12, 7.18.0 ≤ v < 7.21.6, 7.22.0 ≤ v < 8.0.5, 8.1.0 ≤ v < 8.1.5, 8.2.0 ≤ v < 8.2.4, 8.3.0 ≤ v < 8.3.3, 8.4.0 ≤ v < 8.4.2 | 7.6.19, 7.17.12, 7.21.6, 8.0.5, 8.1.5, 8.2.4, 8.3.3, 8.4.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.