VYPR
← All advisories
Unrated severityCISA KEVNVD Advisory· Published Aug 25, 2022· Updated Oct 21, 2025

CVE-2022-36804

CVE-2022-36804

Description

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Atlassian/Bitbucket Data Centerllm-create2 versions
    >=7.0.0, <7.6.17 or >=7.7.0, <7.17.10 or >=7.18.0, <7.21.4 or >=8.0.0, <8.0.3 or >=8.1.0, <8.1.3 or >=8.2.0, <8.2.2 or >=8.3.0, <8.3.1+ 1 more
    • (no CPE)range: >=7.0.0, <7.6.17 or >=7.7.0, <7.17.10 or >=7.18.0, <7.21.4 or >=8.0.0, <8.0.3 or >=8.1.0, <8.1.3 or >=8.2.0, <8.2.2 or >=8.3.0, <8.3.1
    • (no CPE)range: 7.0.0
  • Atlassian/Bitbucket Serverllm-fuzzy2 versions
    >=7.0.0, <7.6.17 or >=7.7.0, <7.17.10 or >=7.18.0, <7.21.4 or >=8.0.0, <8.0.3 or >=8.1.0, <8.1.3 or >=8.2.0, <8.2.2 or >=8.3.0, <8.3.1+ 1 more
    • (no CPE)range: >=7.0.0, <7.6.17 or >=7.7.0, <7.17.10 or >=7.18.0, <7.21.4 or >=8.0.0, <8.0.3 or >=8.1.0, <8.1.3 or >=8.2.0, <8.2.2 or >=8.3.0, <8.3.1
    • (no CPE)range: 7.0.0

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.