← Back to browse · API

CVE-2022-26133

Severity
CRITICAL
CVSS
9.8
EPSS
0.71092
Risk score
64.08
CISA KEV
No
PoC
No
Published
2022-04-20
Modified
2024-10-03
First seen
2026-08-07
Aliases
EUVD-2022-30700, GHSA-2P9P-H8Q6-52G9
Products
Atlassian:Bitbucket Data Center 5.14.0 <unspecified, Atlassian:Bitbucket Data Center 7.18.0 <unspecified, Atlassian:Bitbucket Data Center 7.19.0 <unspecified, Atlassian:Bitbucket Data Center 7.20.0, Atlassian:Bitbucket Data Center 7.7.0 <unspecified, Atlassian:Bitbucket Data Center unspecified <7.17.6, Atlassian:Bitbucket Data Center unspecified <7.18.4, Atlassian:Bitbucket Data Center unspecified <7.19.4, Atlassian:Bitbucket Data Center unspecified <7.6.14
Sources
euvd EUVD-2022-30700

Description

SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java deserialization.

References