$ cve CVE-2022-36804 JSON

CVE-2022-36804 KEV EXPLOIT

8.8

HIGH · CVSS 3.1 · EPSS 99.2% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-10-21.

Description

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Scoring

CVSS	8.8 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS	99.17% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-78
On CISA KEV	yes — remediate by 2022-10-21
Public exploit	yes
Published	2022-08-25
Last modified	2026-06-17

CISA KEV

Name	Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
Added	2022-09-30
Due	2022-10-21
Vendor / product	Atlassian / Bitbucket Server and Data Center
Ransomware use	none reported

Affected (1)

Vendor	Product
atlassian	bitbucket

Public exploits

Source	Title	Date
exploit-db	Bitbucket v7.0.0 - RCE	2023-03-23

References

→ the Explorer · watch your stack · NVD