Detections
Analytics

Atlassian Bitbucket Remote Code Execution

high Web App Scanning Plugin ID 113373

Language:

Synopsis

Atlassian Bitbucket Remote Code Execution

Description

The Atlassian Bitbucket application running on the remote host is affected by a critical command injection vulnerability. A remote attacker with unauthenticated to a public Bitbucket repository, or authenticated access to a private repository can send a malicious HTTP request leading to arbitrary code execution.

Solution

Upgrade to version 7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.3, 8.2.2, 8.3.1 or later.

See Also

http://packetstormsecurity.com/files/168470/Bitbucket-Git-Command-Injection.html

https://jira.atlassian.com/browse/BSERV-13438

Plugin Details

Severity: High

ID: 113373

Type: remote

Published: 10/5/2022

Updated: 12/19/2022

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: High

Score: 8.4

CVSS v2

Risk Factor: High

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2022-36804

CVSS v3

Risk Factor: High

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS Score Source: CVE-2022-36804

Vulnerability Information

CPE: cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 8/23/2022

CISA Known Exploited Vulnerability Due Dates: 10/21/2022

Reference Information

CVE: CVE-2022-36804