← Back to browse · API

CVE-2022-36804

Severity
HIGH
CVSS
8.8
EPSS
0.99077
Risk score
59.68
CISA KEV
Yes
PoC
No
Published
2022-08-25
Modified
2025-10-21
First seen
2026-08-07
Aliases
EUVD-2022-39504, GHSA-VCM2-J8F4-M7FJ
Products
Atlassian:Bitbucket Data Center 7.0.0 <unspecified, Atlassian:Bitbucket Data Center 7.18.0 <unspecified, Atlassian:Bitbucket Data Center 7.7.0 <unspecified, Atlassian:Bitbucket Data Center 8.0.0 <unspecified, Atlassian:Bitbucket Data Center 8.1.0 <unspecified, Atlassian:Bitbucket Data Center 8.2.0 <unspecified, Atlassian:Bitbucket Data Center 8.3.0 <unspecified, Atlassian:Bitbucket Data Center unspecified <7.17.10, Atlassian:Bitbucket Data Center unspecified <7.21.4, Atlassian:Bitbucket Data Center unspecified <7.6.17, Atlassian:Bitbucket Data Center unspecified <8.0.3, Atlassian:Bitbucket Data Center unspecified <8.1.3, Atlassian:Bitbucket Data Center unspecified <8.2.2, Atlassian:Bitbucket Data Center unspecified <8.3.1, Atlassian:Bitbucket Server 7.0.0 <unspecified, Atlassian:Bitbucket Server 7.18.0 <unspecified, Atlassian:Bitbucket Server 7.7.0 <unspecified, Atlassian:Bitbucket Server 8.0.0 <unspecified, Atlassian:Bitbucket Server 8.1.0 <unspecified, Atlassian:Bitbucket Server 8.2.0 <unspecified, Atlassian:Bitbucket Server 8.3.0 <unspecified, Atlassian:Bitbucket Server and Data Center, Atlassian:Bitbucket Server unspecified <7.17.10, Atlassian:Bitbucket Server unspecified <7.21.4, Atlassian:Bitbucket Server unspecified <7.6.17, Atlassian:Bitbucket Server unspecified <8.0.3, Atlassian:Bitbucket Server unspecified <8.1.3, Atlassian:Bitbucket Server unspecified <8.2.2, Atlassian:Bitbucket Server unspecified <8.3.1
Sources
cisa.gov CVE-2022-36804
euvd EUVD-2022-39504

Description

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

References