Every CVE Search/ Get API key

CVE-2022-36804

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17,...

8.8 HighIn KEVPublic exploit

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.1%Up 96.4 points since Aug 25, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Record
CVE-2022-36804
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78, CWE-88
Updated
2026-11-02
CVE List 8.8

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Record
CVE-2022-36804
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78, CWE-88
Updated
2026-11-02
EUVDEUVD-2022-39504 8.8

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Record
EUVD-2022-39504
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-vcm2-j8f4-m7fj 8.8

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17,...

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Record
GHSA-vcm2-j8f4-m7fj
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77, CWE-78
Updated
2026-11-02
CISA KEV No score

Atlassian Bitbucket Server and Data Center Command Injection Vulnerability

Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.

Record
CVE-2022-36804
Weakness
CWE-78, CWE-88, CWE-158
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitBitbucket Git Command Injection2022-08-24
PoC in GitHubnotdls/CVE-2022-368042022-09-07
PoC in GitHubnotxesh/CVE-2022-36804-PoC2022-09-19
PoC in GitHubJRandomSage/CVE-2022-36804-MASS-RCE2022-09-20
PoC in GitHubVulnmachines/bitbucket-cve-2022-368042022-09-20
PoC in GitHubbenjaminhays/CVE-2022-36804-PoC-Exploit2022-09-20
PoC in GitHubkljunowsky/CVE-2022-36804-POC2022-09-21
PoC in GitHubChocapikk/CVE-2022-36804-ReverseShell2022-09-23
PoC in GitHub0xEleven/CVE-2022-36804-ReverseShell2022-09-24
PoC in GitHubkhal4n1/CVE-2022-368042022-09-24
Show 12 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubtahtaciburak/cve-2022-368042022-09-25
PoC in GitHubsh4den/CVE-2022-368042022-09-26
PoC in GitHubColdFusionX/CVE-2022-368042022-10-04
PoC in GitHubdevengpk/CVE-2022-368042022-12-20
PoC in GitHubwalnutsecurity/cve-2022-368042023-01-23
PoC in GitHubimbas007/Atlassian-Bitbucket-CVE-2022-368042023-02-02
Exploit-DBBitbucket v7.0.0 - RCE2023-03-23
PoC in GitHubasepsaepdin/CVE-2022-368042025-01-30
PoC in GitHubDanielHallbro/CVE-2022-36804-Bitbucket-RCE-Analysis2026-02-26
PoC in GitHubJohanGabrielson/bitbucket-test2026-03-24
PoC in GitHubJunohea/cve-2022-368042026-08-21
NucleiAtlassian Bitbucket - Remote Command Injection

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-36804 is a high vulnerability (CVSS 8.8) in Atlassian Bitbucket, published August 25, 2022. CISA lists it as known to be exploited, since September 30, 2022. EUVD reports exploitation since September 30, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.1%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open