CVE-2022-36804

State: Published
Severity: 8.8 High
Published: Aug 25, 2022
Updated: Oct 21, 2025
Reserved: Jul 26, 2022

Description

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected Products

Product	Versions
Bitbucket ServerAtlassian	7.0.0 to before unspecifiedAffected before 7.6.17Affected 7.7.0 to before unspecifiedAffected before 7.17.10Affected 7.18.0 to before unspecifiedAffected before 7.21.4Affected 8.0.0 to before unspecifiedAffected before 8.0.3Affected 8.1.0 to before unspecifiedAffected before 8.1.3Affected 8.2.0 to before unspecifiedAffected before 8.2.2Affected 8.3.0 to before unspecifiedAffected before 8.3.1Affected
Bitbucket Data CenterAtlassian	7.0.0 to before unspecifiedAffected before 7.6.17Affected 7.7.0 to before unspecifiedAffected before 7.17.10Affected 7.18.0 to before unspecifiedAffected before 7.21.4Affected 8.0.0 to before unspecifiedAffected before 8.0.3Affected 8.1.0 to before unspecifiedAffected before 8.1.3Affected 8.2.0 to before unspecifiedAffected before 8.2.2Affected 8.3.0 to before unspecifiedAffected before 8.3.1Affected

Product

Versions

Bitbucket ServerAtlassian

7.0.0 to before unspecifiedAffected
before 7.6.17Affected
7.7.0 to before unspecifiedAffected
before 7.17.10Affected
7.18.0 to before unspecifiedAffected
before 7.21.4Affected
8.0.0 to before unspecifiedAffected
before 8.0.3Affected
8.1.0 to before unspecifiedAffected
before 8.1.3Affected
8.2.0 to before unspecifiedAffected
before 8.2.2Affected
8.3.0 to before unspecifiedAffected
before 8.3.1Affected

Bitbucket Data CenterAtlassian

7.0.0 to before unspecifiedAffected
before 7.6.17Affected
7.7.0 to before unspecifiedAffected
before 7.17.10Affected
7.18.0 to before unspecifiedAffected
before 7.21.4Affected
8.0.0 to before unspecifiedAffected
before 8.0.3Affected
8.1.0 to before unspecifiedAffected
before 8.1.3Affected
8.2.0 to before unspecifiedAffected
before 8.2.2Affected
8.3.0 to before unspecifiedAffected
before 8.3.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.