{"id":"CVE-2022-43781","published":"2022-11-17T00:00:01Z","modified":"2024-10-02T14:56:09Z","title":"There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center","vendor":"Atlassian","product":"Bitbucket Data Center","tier":"core","eol":null,"affectedVersions":[{"vendor":"Atlassian","product":"Bitbucket Data Center","versions":["before 7.17.12","before 7.21.6","before 7.6.19","before 8.0.5","before 8.1.5","before 8.2.4","before 8.3.3","before 8.4.2","before 8.5.0"]},{"vendor":"Atlassian","product":"Bitbucket Server","versions":["before 7.17.12","before 7.21.6","before 7.6.19","before 8.0.5","before 8.1.5","before 8.2.4","before 8.3.3","before 8.4.2","before 8.5.0"]}],"description":{"text":"There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a command injection vulnerability in Atlassian's Bitbucket Data Center, triggered through environment variables. An attacker who can control their own username can execute arbitrary code on the system, and no authentication is needed if the instance has \"Allow public signup\" enabled.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:55Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.98035,"percentile":0.9991,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"Threat Intel Report - W48-2022.pdf","url":"https://otx.alienvault.com/pulse/637b30662e1183e22aee7371","created":"2022-11-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"https://confluence.atlassian.com/x/Y4hXRg","tags":[]},{"url":"https://jira.atlassian.com/browse/BSERV-13522","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-46751","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46751","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Bitbucket Environment Variable RCE","module":"exploit/multi/http/bitbucket_env_var_rce","type":"exploit","disclosureDate":"2022-11-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/bitbucket_env_var_rce.rb"}],"first":{"date":"2022-11-16","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/bitbucket_env_var_rce.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-11-16","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/bitbucket_env_var_rce.rb","provenance":"source"},{"date":"2022-11-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-43781","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":32.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9991"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}