ZeroDay Findings
Sign inSign up

Findings

CVE-2022-36804

Atlassian Bitbucket Server and Data Center Command Injection Vulnerability

Published Aug 24, 2022 · updated Jun 16, 2026 · atlassian bitbucket

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 24, 2022 · Catalog

    Detected

    Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a pu

  2. Sep 30, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Oct 21, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a pu

Required action

Apply updates per vendor instructions.

CISA due date Oct 21, 2022

Affected

  • cpe atlassian/bitbucketversion unspecified
  • cpe atlassian/bitbucket8.3.0
  • vendor Atlassian Bitbucket Server and Data Centerversion unspecified

Sources

  • CISA KEVCVE-2022-36804

    Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.

    cisa.gov
  • CVE.orgCVE-2022-36804

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2022-36804

    30-day exploitation probability 99.1%

    first.org
  • Exploit Database51040

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_linux/http/bitbucket_git_cmd_injection

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2022-36804

    Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from versi

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/168470/Bitbucket-Git-Command-Injection.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securityhttp://packetstormsecurity.com/files/171453/Bitbucket-7.0.0-Remote-Command-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References