CVE-2022-43781 - Vulnerability Details - OpenCVE

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.91715.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Atlassian	Bitbucket

Configuration 1 [-]

OR	cpe:2.3:a:atlassian:bitbucket::::::::
	cpe:2.3:a:atlassian:bitbucket::::::::
	cpe:2.3:a:atlassian:bitbucket::::::::
	cpe:2.3:a:atlassian:bitbucket::::::::
	cpe:2.3:a:atlassian:bitbucket::::::::
	cpe:2.3:a:atlassian:bitbucket::::::::
	cpe:2.3:a:atlassian:bitbucket::::::::
	cpe:2.3:a:atlassian:bitbucket::::::::

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://confluence.atlassian.com/x/Y4hXRg
https://jira.atlassian.com/browse/BSERV-13522

History

Wed, 02 Oct 2024 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: atlassian

Published: 2022-11-17T00:00:01.210Z

Updated: 2024-10-02T14:56:09.693Z

Reserved: 2022-10-26T14:49:11.114Z

Link: CVE-2022-43781

Vulnrichment

Updated: 2024-08-03T13:40:06.623Z

NVD

Status : Modified

Published: 2022-11-17T00:15:18.483

Modified: 2024-11-21T07:27:14.543

Link: CVE-2022-43781

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-43781", "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "state": "PUBLISHED", "assignerShortName": "atlassian", "requesterUserId": "4ceb4895-2afc-4c29-bf72-c2e04b367c52", "dateReserved": "2022-10-26T14:49:11.114Z", "datePublished": "2022-11-17T00:00:01.210Z", "dateUpdated": "2024-10-02T14:56:09.693Z"}, "containers": {"cna": {"affected": [{"vendor": "Atlassian", "product": "Bitbucket Data Center", "versions": [{"version": "before 7.0", "status": "unaffected"}, {"version": "before 7.17.12", "status": "affected"}, {"version": "before 7.21.6", "status": "affected"}, {"version": "before 7.6.19", "status": "affected"}, {"version": "before 8.0.5", "status": "affected"}, {"version": "before 8.1.5", "status": "affected"}, {"version": "before 8.2.4", "status": "affected"}, {"version": "before 8.3.3", "status": "affected"}, {"version": "before 8.4.2", "status": "affected"}, {"version": "before 8.5.0", "status": "affected"}]}, {"vendor": "Atlassian", "product": "Bitbucket Server", "versions": [{"version": "before 7.0", "status": "unaffected"}, {"version": "before 7.17.12", "status": "affected"}, {"version": "before 7.21.6", "status": "affected"}, {"version": "before 7.6.19", "status": "affected"}, {"version": "before 8.0.5", "status": "affected"}, {"version": "before 8.1.5", "status": "affected"}, {"version": "before 8.2.4", "status": "affected"}, {"version": "before 8.3.3", "status": "affected"}, {"version": "before 8.4.2", "status": "affected"}, {"version": "before 8.5.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled \u201cAllow public signup\u201d."}], "problemTypes": [{"descriptions": [{"description": "RCE (Remote Code Execution)", "lang": "en", "type": "RCE (Remote Code Execution)"}]}], "references": [{"url": "https://confluence.atlassian.com/x/Y4hXRg"}, {"url": "https://jira.atlassian.com/browse/BSERV-13522"}], "credits": [{"lang": "en", "value": "https://github.com/Ry0taK"}], "providerMetadata": {"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian", "dateUpdated": "2022-11-17T00:00:01.210Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:40:06.623Z"}, "title": "CVE Program Container", "references": [{"url": "https://confluence.atlassian.com/x/Y4hXRg", "tags": ["x_transferred"]}, {"url": "https://jira.atlassian.com/browse/BSERV-13522", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "affected": [{"vendor": "atlassian", "product": "bitbucket", "cpes": ["cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "7.0.0", "status": "affected", "lessThan": "7.6.19", "versionType": "custom"}, {"version": "7.7.0", "status": "affected", "lessThan": "7.17.12", "versionType": "custom"}, {"version": "7.18.0", "status": "affected", "lessThan": "7.21.6", "versionType": "custom"}, {"version": "7.22.0", "status": "affected", "lessThan": "8.0.5", "versionType": "custom"}, {"version": "8.1.0", "status": "affected", "lessThan": "8.1.5", "versionType": "custom"}, {"version": "8.2.0", "status": "affected", "lessThan": "8.2.4", "versionType": "custom"}, {"version": "8.3.0", "status": "affected", "lessThan": "8.3.3", "versionType": "custom"}, {"version": "8.4.0", "status": "affected", "lessThan": "8.4.2", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-10-02T14:27:57.305026Z", "id": "CVE-2022-43781", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T14:56:09.693Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://confluence.atlassian.com/x/Y4hXRg", "tags": ["x_transferred"]}, {"url": "https://jira.atlassian.com/browse/BSERV-13522", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:40:06.623Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-43781", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-02T14:27:57.305026Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*"], "vendor": "atlassian", "product": "bitbucket", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.6.19", "versionType": "custom"}, {"status": "affected", "version": "7.7.0", "lessThan": "7.17.12", "versionType": "custom"}, {"status": "affected", "version": "7.18.0", "lessThan": "7.21.6", "versionType": "custom"}, {"status": "affected", "version": "7.22.0", "lessThan": "8.0.5", "versionType": "custom"}, {"status": "affected", "version": "8.1.0", "lessThan": "8.1.5", "versionType": "custom"}, {"status": "affected", "version": "8.2.0", "lessThan": "8.2.4", "versionType": "custom"}, {"status": "affected", "version": "8.3.0", "lessThan": "8.3.3", "versionType": "custom"}, {"status": "affected", "version": "8.4.0", "lessThan": "8.4.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T14:55:51.362Z"}}], "cna": {"credits": [{"lang": "en", "value": "https://github.com/Ry0taK"}], "affected": [{"vendor": "Atlassian", "product": "Bitbucket Data Center", "versions": [{"status": "unaffected", "version": "before 7.0"}, {"status": "affected", "version": "before 7.17.12"}, {"status": "affected", "version": "before 7.21.6"}, {"status": "affected", "version": "before 7.6.19"}, {"status": "affected", "version": "before 8.0.5"}, {"status": "affected", "version": "before 8.1.5"}, {"status": "affected", "version": "before 8.2.4"}, {"status": "affected", "version": "before 8.3.3"}, {"status": "affected", "version": "before 8.4.2"}, {"status": "affected", "version": "before 8.5.0"}]}, {"vendor": "Atlassian", "product": "Bitbucket Server", "versions": [{"status": "unaffected", "version": "before 7.0"}, {"status": "affected", "version": "before 7.17.12"}, {"status": "affected", "version": "before 7.21.6"}, {"status": "affected", "version": "before 7.6.19"}, {"status": "affected", "version": "before 8.0.5"}, {"status": "affected", "version": "before 8.1.5"}, {"status": "affected", "version": "before 8.2.4"}, {"status": "affected", "version": "before 8.3.3"}, {"status": "affected", "version": "before 8.4.2"}, {"status": "affected", "version": "before 8.5.0"}]}], "references": [{"url": "https://confluence.atlassian.com/x/Y4hXRg"}, {"url": "https://jira.atlassian.com/browse/BSERV-13522"}], "descriptions": [{"lang": "en", "value": "There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled \u201cAllow public signup\u201d."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "RCE (Remote Code Execution)", "description": "RCE (Remote Code Execution)"}]}], "providerMetadata": {"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian", "dateUpdated": "2022-11-17T00:00:01.210Z"}}}, "cveMetadata": {"cveId": "CVE-2022-43781", "state": "PUBLISHED", "dateUpdated": "2024-10-02T14:56:09.693Z", "dateReserved": "2022-10-26T14:49:11.114Z", "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "datePublished": "2022-11-17T00:00:01.210Z", "requesterUserId": "4ceb4895-2afc-4c29-bf72-c2e04b367c52", "assignerShortName": "atlassian"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", "matchCriteriaId": "724D75B1-262B-4834-BDF9-359992FE358F", "versionEndExcluding": "7.6.19", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", "matchCriteriaId": "7DDB30B8-27BB-4754-A801-CC6D7FBD112D", "versionEndExcluding": "7.17.12", "versionStartIncluding": "7.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", "matchCriteriaId": "C46D83C6-2375-4187-9A5F-1AD81A6520DA", "versionEndExcluding": "7.21.6", "versionStartIncluding": "7.18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", "matchCriteriaId": "18D68073-ED08-433F-9EB3-6BE4D58B08E6", "versionEndExcluding": "8.0.5", "versionStartIncluding": "7.22.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C1B0213-8CA7-4179-90D3-FCFE8BBE33BA", "versionEndExcluding": "8.1.5", "versionStartIncluding": "8.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", "matchCriteriaId": "0D270F32-1BB2-46F8-8737-4CB39508EDD4", "versionEndExcluding": "8.2.4", "versionStartIncluding": "8.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF6224A3-4AD8-4DA7-8E68-A890B3915337", "versionEndExcluding": "8.3.3", "versionStartIncluding": "8.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", "matchCriteriaId": "224634CB-9CA5-4292-B3F8-B3A86E4ADD70", "versionEndExcluding": "8.4.2", "versionStartIncluding": "8.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled \u201cAllow public signup\u201d."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyecci\u00f3n de comandos mediante variables de entorno en Bitbucket Server y Data Center. Un atacante con permiso para controlar su nombre de usuario puede aprovechar este problema para ejecutar c\u00f3digo arbitrario en el sistema. Esta vulnerabilidad puede no autenticarse si la instancia de Bitbucket Server y Data Center ha habilitado \"Allow public signup\"."}], "id": "CVE-2022-43781", "lastModified": "2024-11-21T07:27:14.543", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-11-17T00:15:18.483", "references": [{"source": "security@atlassian.com", "tags": ["Mitigation", "Release Notes", "Vendor Advisory"], "url": "https://confluence.atlassian.com/x/Y4hXRg"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/BSERV-13522"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Release Notes", "Vendor Advisory"], "url": "https://confluence.atlassian.com/x/Y4hXRg"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/BSERV-13522"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-77"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}