Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2022-43781

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this i

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
atlassian

Description

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Atlassian Bitbucket Data Center

  • before 7.0unaffected
  • before 7.17.12affected
  • before 7.21.6affected
  • before 7.6.19affected
  • before 8.0.5affected
  • before 8.1.5affected
  • before 8.2.4affected
  • before 8.3.3affected
  • before 8.4.2affected
  • before 8.5.0affected

Atlassian Bitbucket Server

  • before 7.0unaffected
  • before 7.17.12affected
  • before 7.21.6affected
  • before 7.6.19affected
  • before 8.0.5affected
  • before 8.1.5affected
  • before 8.2.4affected
  • before 8.3.3affected
  • before 8.4.2affected
  • before 8.5.0affected

References