{"id":"CVE-2022-26133","state":"PUBLISHED","title":"SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19","description":"SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java deserialization.","publishedAt":"2022-04-20T18:30:19.225Z","updatedAt":"2024-10-03T14:55:36.962Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"atlassian","products":["Atlassian Bitbucket Data Center"],"affected":[{"vendor":"Atlassian","product":"Bitbucket Data Center","versions":[{"version":"5.14.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.6.14","versionType":"custom"},{"version":"7.7.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.17.6","versionType":"custom"},{"version":"7.18.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.18.4","versionType":"custom"},{"version":"7.19.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.19.4","versionType":"custom"},{"version":"7.20.0","status":"affected"}]}],"references":["https://jira.atlassian.com/browse/BSERV-13173","https://confluence.atlassian.com/security/multiple-products-security-advisory-hazelcast-vulnerable-to-remote-code-execution-cve-2016-10750-1116292387.html"],"weaknesses":["CWE-502"],"ingestedAt":"2026-10-29T19:49:49.689Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/26xxx/CVE-2022-26133.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-26133","state":"PUBLISHED","datePublished":"2022-04-20T18:30:19.225Z","dateUpdated":"2024-10-03T14:55:36.962Z","assignerShortName":"atlassian","assignerOrgId":"f08a6ab8-ed46-4c22-8884-d911ccfe3c66","dateReserved":"2022-02-25T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java deserialization."}],"affected":[{"vendor":"Atlassian","product":"Bitbucket Data Center","versions":[{"version":"5.14.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.6.14","versionType":"custom"},{"version":"7.7.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.17.6","versionType":"custom"},{"version":"7.18.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.18.4","versionType":"custom"},{"version":"7.19.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"7.19.4","versionType":"custom"},{"version":"7.20.0","status":"affected"}]}],"references":[{"url":"https://jira.atlassian.com/browse/BSERV-13173","tags":["x_refsource_MISC"]},{"url":"https://confluence.atlassian.com/security/multiple-products-security-advisory-hazelcast-vulnerable-to-remote-code-execution-cve-2016-10750-1116292387.html","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"description":"Deserialization of untrusted data","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"atlassian","dateUpdated":"2022-04-20T18:30:19.000Z","orgId":"f08a6ab8-ed46-4c22-8884-d911ccfe3c66"},"datePublic":"2022-03-24T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@atlassian.com","DATE_PUBLIC":"2022-03-24T23:00:00","ID":"CVE-2022-26133","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Bitbucket Data Center","version":{"version_data":[{"version_affected":">=","version_value":"5.14.0"},{"version_affected":"<","version_value":"7.6.14"},{"version_affected":">=","version_value":"7.7.0"},{"version_affected":"<","version_value":"7.17.6"},{"version_affected":">=","version_value":"7.18.0"},{"version_affected":"<","version_value":"7.18.4"},{"version_affected":">=","version_value":"7.19.0"},{"version_affected":"<","version_value":"7.19.4"},{"version_affected":"=","version_value":"7.20.0"}]}}]},"vendor_name":"Atlassian"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java deserialization."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Deserialization of untrusted data"}]}]},"references":{"reference_data":[{"name":"https://jira.atlassian.com/browse/BSERV-13173","refsource":"MISC","url":"https://jira.atlassian.com/browse/BSERV-13173"},{"name":"https://confluence.atlassian.com/security/multiple-products-security-advisory-hazelcast-vulnerable-to-remote-code-execution-cve-2016-10750-1116292387.html","refsource":"MISC","url":"https://confluence.atlassian.com/security/multiple-products-security-advisory-hazelcast-vulnerable-to-remote-code-execution-cve-2016-10750-1116292387.html"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://jira.atlassian.com/browse/BSERV-13173","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://confluence.atlassian.com/security/multiple-products-security-advisory-hazelcast-vulnerable-to-remote-code-execution-cve-2016-10750-1116292387.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T04:56:37.656Z"}},{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"atlassian","product":"bitbucket_data_center","defaultStatus":"unknown","versions":[{"version":"5.14.0","status":"affected","lessThan":"7.6.14","versionType":"custom"},{"version":"7.7.0","status":"affected","lessThan":"7.17.6","versionType":"custom"},{"version":"7.18.0","status":"affected","lessThan":"7.18.4","versionType":"custom"},{"version":"7.19.0","status":"affected","lessThan":"7.19.4","versionType":"custom"}],"cpes":["cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*"]},{"vendor":"atlassian","product":"bitbucket_data_center","defaultStatus":"unknown","versions":[{"version":"7.20.0","status":"affected"}],"cpes":["cpe:2.3:a:atlassian:bitbucket_data_center:7.20.0:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-10-03T14:41:09.024921Z","id":"CVE-2022-26133","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","type":"CWE","lang":"en","description":"CWE-502 Deserialization of Untrusted Data"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-03T14:55:36.962Z"}}]}}}