← Zuruck zu CVEs
CVE-2022-43781
CRITICAL9.8
Beschreibung
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.
CVE Details
CVSS v3.1 Bewertung9.8
SchweregradCRITICAL
CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AngriffsvektorNETWORK
KomplexitatLOW
Erforderliche PrivilegienNONE
BenutzerinteraktionNONE
Veroffentlicht11/17/2022
Zuletzt geandert11/21/2024
Quellenvd
Honeypot-Sichtungen0
Betroffene Produkte
atlassian:bitbucket
Schwachen (CWE)
CWE-77CWE-77
Referenzen
https://confluence.atlassian.com/x/Y4hXRg(security@atlassian.com)
https://jira.atlassian.com/browse/BSERV-13522(security@atlassian.com)
https://confluence.atlassian.com/x/Y4hXRg(af854a3a-2127-422b-91ae-364da2661108)
https://jira.atlassian.com/browse/BSERV-13522(af854a3a-2127-422b-91ae-364da2661108)
IOC Korrelationen
Keine Korrelationen erfasst
This product uses data from the NVD API but is not endorsed or certified by the NVD.