High severity8.8CISA KEVNVD Advisory· Published Aug 25, 2022· Updated Jun 17, 2026
CVE-2022-36804
CVE-2022-36804
Description
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*range: >=7.0.0,<7.6.17
- cpe:2.3:a:atlassian:bitbucket:8.3.0:*:*:*:*:*:*:*
- (no CPE)range: <7.6.17, <7.17.10, <7.21.4, <8.0.3, <8.1.3, <8.2.2, <8.3.1
- (no CPE)range: 7.0.0
<7.6.17, <7.17.10, <7.21.4, <8.0.3, <8.1.3, <8.2.2, <8.3.1+ 1 more
- (no CPE)range: <7.6.17, <7.17.10, <7.21.4, <8.0.3, <8.1.3, <8.2.2, <8.3.1
- (no CPE)range: 7.0.0
Patches
Vulnerability mechanics
References
4- jira.atlassian.com/browse/BSERV-13438nvdIssue TrackingPatchRelease NotesVendor Advisory
- packetstormsecurity.com/files/168470/Bitbucket-Git-Command-Injection.htmlnvdExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/171453/Bitbucket-7.0.0-Remote-Command-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
0No linked articles in our index yet.