CVE-2022-36804

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78CWE-88

Affected software

VendorProductVersions
AtlassianBitbucket Server>= 7.0.0, < unspecified; >= unspecified, < 7.6.17; >= 7.7.0, < unspecified; >= unspecified, < 7.17.10; >= 7.18.0, < unspecified; >= unspecified, < 7.21.4; >= 8.0.0, < unspecified; >= unspecified, < 8.0.3; >= 8.1.0, < unspecified; >= unspecified, < 8.1.3; >= 8.2.0, < unspecified; >= unspecified, < 8.2.2; >= 8.3.0, < unspecified; >= unspecified, < 8.3.1
AtlassianBitbucket Data Center>= 7.0.0, < unspecified; >= unspecified, < 7.6.17; >= 7.7.0, < unspecified; >= unspecified, < 7.17.10; >= 7.18.0, < unspecified; >= unspecified, < 7.21.4; >= 8.0.0, < unspecified; >= unspecified, < 8.0.3; >= 8.1.0, < unspecified; >= unspecified, < 8.1.3; >= 8.2.0, < unspecified; >= unspecified, < 8.2.2; >= 8.3.0, < unspecified; >= unspecified, < 8.3.1

References

Timeline

Published
Aug 25, 2022
Last modified
Jun 17, 2026
Added to CISA KEV
Sep 30, 2022
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-36816.5A vulnerability has been identified in the MR2600 router v1.0.18 and earlier that could allow an attacker within range of the wireless netwoCVE-2022-36828.8A vulnerability exists in the SDM600 file permission validation. An attacker could exploit the vulnerability by gaining access to the systeCVE-2022-368295.5PendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to version 1.2.3 allows local attackers to access files withCVE-2022-36837.5A vulnerability exists in the SDM600 API web services authorization validation implementation. An attacker who successfully exploits the vuCVE-2022-368305.5PendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to version 1.2.3 allows local attackers to access fileCVE-2022-368315.5Path traversal vulnerability in UriFileUtils of Samsung Notes prior to version 4.3.14.39 allows attacker to access some file as Samsung NoteCVE-2022-368323.3Improper access control vulnerability in WebApp in Cameralyzer prior to versions 3.2.22, 3.3.22, 3.4.22 and 3.5.51 allows attackers to accesCVE-2022-368337.8Improper Privilege Management vulnerability in Game Optimizing Service prior to versions 3.3.04.0 in Android 10, and 3.5.04.8 in Android 11 CVE-2022-368345.0Exposure of Sensitive Information vulnerability in Game Launcher prior to version 6.0.07 allows local attacker to access app data with user CVE-2022-368353.3Implicit Intent hijacking vulnerability in Samsung Internet Browser prior to version 17.0.7.34 allows attackers to access arbitrary files.CVE-2022-368365.5Unprotected provider vulnerability in Charm by Samsung prior to version 1.2.3 allows attackers to read connection state without permission.CVE-2022-368375.5Intent redirection vulnerability using implicit intent in Samsung email prior to version 6.1.70.20 allows attacker to get sensitive informat
CVE-2022-36804: High severity, CVSS 8.8 | Vulnix