← Back to browse · API

CVE-2022-43781

Severity
CRITICAL
CVSS
9.8
EPSS
0.98076
Risk score
73.53
CISA KEV
No
PoC
No
Published
2022-11-17
Modified
2024-10-02
First seen
2026-08-07
Aliases
EUVD-2022-46751, GHSA-3883-H64P-R3XM
Products
Atlassian:Bitbucket Data Center before 8.5.0, Atlassian:Bitbucket Server before 8.0.5, Atlassian:Bitbucket Server before 8.1.5, Atlassian:Bitbucket Server before 8.2.4, Atlassian:Bitbucket Data Center before 8.0.5, Atlassian:Bitbucket Server before 7.6.19, Atlassian:Bitbucket Data Center before 7.21.6, Atlassian:Bitbucket Server before 7.17.12, Atlassian:Bitbucket Data Center before 8.2.4, Atlassian:Bitbucket Data Center before 8.3.3, Atlassian:Bitbucket Server before 8.4.2, Atlassian:Bitbucket Server before 8.5.0, Atlassian:Bitbucket Data Center before 8.1.5, Atlassian:Bitbucket Data Center before 7.6.19, Atlassian:Bitbucket Data Center before 8.4.2, Atlassian:Bitbucket Server before 7.21.6, Atlassian:Bitbucket Server before 8.3.3, Atlassian:Bitbucket Data Center before 7.17.12
Sources
euvd EUVD-2022-46751

Description

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.

References