{"id":"CVE-2022-36804","kind":"vulnerability","aliases":["CVE-2022-36804"],"related":[],"title":"Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0…","description":"Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.","summary":"Multiple Bitbucket Server and Data Center API endpoints have a command injection flaw. An attacker who can read a repository, including any public one, can run code on the server with a crafted HTTP request.","severity":"critical","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2022-09-30T00:00:00+00:00","products":[{"name":"Atlassian Bitbucket Server and Data Center","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"atlassian bitbucket","fixed":["7.6.17"],"affected":">= 7.0.0, < 7.6.17","ecosystem":"vendor"},{"name":"atlassian bitbucket","fixed":["7.17.10"],"affected":">= 7.7.0, < 7.17.10","ecosystem":"vendor"},{"name":"atlassian bitbucket","fixed":["7.21.4"],"affected":">= 7.18.0, < 7.21.4","ecosystem":"vendor"},{"name":"atlassian bitbucket","fixed":["8.0.3"],"affected":">= 8.0.0, < 8.0.3","ecosystem":"vendor"},{"name":"atlassian bitbucket","fixed":["8.1.3"],"affected":">= 8.1.0, < 8.1.3","ecosystem":"vendor"},{"name":"atlassian bitbucket","fixed":["8.2.2"],"affected":">= 8.2.0, < 8.2.2","ecosystem":"vendor"},{"name":"atlassian bitbucket","fixed":[],"affected":"= 8.3.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["atlassian","bitbucket","exploited","self-hosted","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the Atlassian update for CVE-2022-36804 per vendor instructions; the sources do not name the fixed version.","status":"open","published_at":"2022-08-25T06:15:09+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:33+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T21:10:33Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Atlassian update for CVE-2022-36804 per vendor instructions; the sources do not name the fixed version.","reach":"internet","impact":"high","summary":"Multiple Bitbucket Server and Data Center API endpoints have a command injection flaw. An attacker who can read a repository, including any public one, can run code on the server with a crafted HTTP request.","category":"vendor","who_cares":["bitbucket","self-hosted","atlassian"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker runs code on the Bitbucket server via crafted HTTP request","analyst_note":"Find the fixed Bitbucket Server version and the vendor advisory from Atlassian; the KEV entry only says apply vendor updates.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000456,"input_tokens":2851,"output_tokens":341,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':19A,22A '-36804':20A,23A '7.0.0':11A,96C '7.17.10':105C '7.18.0':108C '7.21.4':111C '7.6.17':14A,99C '7.7.0':17A,102C '8.0.0':114C '8.0.3':117C '8.1.0':120C '8.1.3':123C '8.2.0':127C '8.2.2':130C '8.3.0':134C '8.3.1':136C 'allow':137C 'and':27A 'api':2A,57B,87C 'arbitrari':152C 'atlassian':5A,24A,30A,32A,34A,36A,38A,40A,42A,44B,90C 'attack':65B,139C 'bitbucket':6A,25A,31A,33A,35A,37A,39A,41A,43A,45B,52B,91C,148C 'bounti':167C 'bug':166C 'center':10A,29A,56B,95C 'code':77B,153C 'command':61B 'craft':83B 'cve':18A,21A 'data':9A,28A,55B,94C 'endpoint':3A,58B,88C 'execut':151C 'exploit':46B 'flaw':63B 'host':49B 'http':84B,158C 'includ':71B 'inject':62B 'malici':157C 'multipl':1A,51B,86C 'one':74B 'permiss':142C 'privat':147C 'program':168C 'public':73B,145C 'read':68B,141C 'remot':138C 'report':163C 'repositori':70B,149C 'request':85B,159C 'run':76B 'self':48B 'self-host':47B 'send':155C 'server':7A,26A,53B,80B,92C 'thegrandpew':170C 'vendor':50B 'version':13A,16A,98C,101C,104C,107C,110C,113C,116C,119C,122C,126C,129C,133C 'via':164C 'vulner':161C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-08-25T06:15:09+00:00","kev":{"dateAdded":"2022-09-30","dueDate":"2022-10-21","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-36804","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-36804","severity":null,"published_at":"2022-09-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-36804","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36804","severity":null,"published_at":"2022-08-25T06:15:09+00:00","modified_at":"2026-06-17T04:54:00+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}