{"id":"CVE-2022-36804","published":"2022-08-25T06:15:09Z","modified":"2026-06-17T04:54:00Z","title":"Atlassian Bitbucket Server and Data Center Command Injection Vulnerability","vendor":"Atlassian","product":"Bitbucket Server and Data Center","tier":"core","eol":null,"description":{"text":"Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.","provenance":"source","from":"NVD"},"summary":{"text":"Atlassian Bitbucket Server and Data Center has a command injection flaw in multiple API endpoints, caused by improper neutralisation of special elements, argument delimiters and null bytes passed to OS commands. An attacker with read permission to a public or private repository can execute arbitrary code by sending a malicious HTTP request, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:40Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99077,"percentile":0.99933,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-09-30","dueDate":"2022-10-21","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://jira.atlassian.com/browse/BSERV-13438;  https://nvd.nist.gov/vuln/detail/CVE-2022-36804","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-09-30","exploitedFirstSeen":"2022-09-30","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-09-30"},{"url":"https://web.archive.org/web/20230318134256/https://unit42.paloaltonetworks.com/network-security-trends-aug-oct-2022/","date":"2023-01-12"},{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-enterprise-applications-honeypot-unveiling-findings-from-six-worldwide-locations/","date":"2023-07-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2022-36804","date":"2023-11-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-14&host_type=src&vulnerability=cve-2022-36804","date":"2023-11-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-17&host_type=src&vulnerability=cve-2022-36804","date":"2023-11-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-19&host_type=src&vulnerability=cve-2022-36804","date":"2023-11-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-22&host_type=src&vulnerability=cve-2022-36804","date":"2023-11-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-06&host_type=src&vulnerability=cve-2022-36804","date":"2024-01-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-07&host_type=src&vulnerability=cve-2022-36804","date":"2024-01-07"}],"evidenceTotal":93,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"},{"id":"CWE-88","name":"Improper Neutralization of Argument Delimiters in a Command"},{"id":"CWE-158","name":"Improper Neutralization of Null Byte or NUL Character"}],"references":[{"url":"http://packetstormsecurity.com/files/168470/Bitbucket-Git-Command-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/171453/Bitbucket-7.0.0-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://jira.atlassian.com/browse/BSERV-13438","tags":["Issue Tracking","Patch","Release Notes","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/168470/Bitbucket-Git-Command-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/171453/Bitbucket-7.0.0-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://jira.atlassian.com/browse/BSERV-13438","tags":["Issue Tracking","Patch","Release Notes","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-36804","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability allows remote attackers with read permissions to a public or private Bitbucket repositories to execute arbitrary code by sending a malicious HTTP request.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability allows remote attackers with read permissions to a public or private Bitbucket repositories to execute arbitrary code by sending a malicious HTTP request.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-39504","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-39504","exploited":true,"exploitedSince":"2022-09-30","provenance":"source"},"exploits":[{"id":51040,"url":"https://www.exploit-db.com/exploits/51040","title":"Bitbucket v7.0.0 -  RCE","type":"webapps","platform":"python","date":"2023-03-23","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2023-03-23"},"pocGithub":{"count":16,"skipped":3,"earliest":"2022-09-07","earliestUrl":"https://github.com/notdls/CVE-2022-36804","repos":[{"name":"notdls/CVE-2022-36804","url":"https://github.com/notdls/CVE-2022-36804","stars":35,"created":"2022-09-07"},{"name":"notxesh/CVE-2022-36804-PoC","url":"https://github.com/notxesh/CVE-2022-36804-PoC","stars":18,"created":"2022-09-19"},{"name":"benjaminhays/CVE-2022-36804-PoC-Exploit","url":"https://github.com/benjaminhays/CVE-2022-36804-PoC-Exploit","stars":16,"created":"2022-09-20"},{"name":"sh4den/CVE-2022-36804","url":"https://github.com/sh4den/CVE-2022-36804","stars":12,"created":"2022-09-26"},{"name":"walnutsecurity/cve-2022-36804","url":"https://github.com/walnutsecurity/cve-2022-36804","stars":8,"created":"2023-01-23"}]},"metasploit":[{"name":"Bitbucket Git Command Injection","module":"exploit/linux/http/bitbucket_git_cmd_injection","type":"exploit","disclosureDate":"2022-08-24","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/bitbucket_git_cmd_injection.rb"}],"nuclei":[{"id":"CVE-2022-36804","name":"Atlassian Bitbucket - Remote Command Injection","severity":"high","path":"http/cves/2022/CVE-2022-36804.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36804.yaml"}],"first":{"date":"2022-08-24","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/bitbucket_git_cmd_injection.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"Atlassian Bitbucket Command Injection Via Archive API","id":"65c0a0ab-d675-4441-bd6b-d3db226a2685","level":"high","status":"test","path":"rules-emerging-threats/2022/Exploits/CVE-2022-36804/web_cve_2022_36804_atlassian_bitbucket_command_injection.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-36804/web_cve_2022_36804_atlassian_bitbucket_command_injection.yml","techniques":["T1190"]}]},"exploitRefs":["http://packetstormsecurity.com/files/168470/Bitbucket-Git-Command-Injection.html","http://packetstormsecurity.com/files/171453/Bitbucket-7.0.0-Remote-Command-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2022-08-24","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2022-09-07, Exploit-DB 2023-03-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/bitbucket_git_cmd_injection.rb","provenance":"source"},{"date":"2022-08-25","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36804","provenance":"source"},{"date":"2022-09-30","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-09-30","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-09-30","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-39504","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":36},"priority":{"score":69.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1491 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9993"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 16 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}