Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

CVE-2022-36804

🗓️ 25 Aug 2022 05:40:08Reported by atlassianType 
cve
 cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 1184 Views🌐 WEB

CVE-2022-36804: Multiple API endpoints in Atlassian Bitbucket Server and Data Center versions before 8.3.1 allow remote code execution

Related
Detection
Affected
Refs
Paths
Social
ReporterTitlePublishedViews
Family
githubexploit
GithubExploit		Exploit for Argument Injection in Atlassian Bitbucket
24 Sep 202205:04
–githubexploit
githubexploit
GithubExploit		Exploit for Argument Injection in Atlassian Bitbucket
26 Feb 202620:42
–githubexploit
githubexploit
GithubExploit		Exploit for Argument Injection in Atlassian Bitbucket
20 Sep 202202:35
–githubexploit
githubexploit
GithubExploit		Exploit for Argument Injection in Atlassian Bitbucket
20 Sep 202201:30
–githubexploit
githubexploit
GithubExploit		Exploit for Argument Injection in Atlassian Bitbucket
20 Sep 202202:35
–githubexploit
githubexploit
GithubExploit		Exploit for Argument Injection in Atlassian Bitbucket
23 Jan 202312:51
–githubexploit
githubexploit
GithubExploit		Exploit for Argument Injection in Atlassian Bitbucket
23 Sep 202211:05
–githubexploit
githubexploit
GithubExploit		Exploit for Argument Injection in Atlassian Bitbucket
25 Sep 202213:16
–githubexploit
githubexploit
GithubExploit		Exploit for Argument Injection in Atlassian Bitbucket
30 Jan 202515:52
–githubexploit
githubexploit
GithubExploit		Exploit for OS Command Injection in Atlassian Bitbucket
21 Aug 202602:14
–githubexploit
Rows per page
NVD
Node
OR
atlassianbitbucketRange7.0.0–7.6.17
atlassianbitbucketRange7.7.0–7.17.10
atlassianbitbucketRange7.18.0–7.21.4
atlassianbitbucketRange8.0.0–8.0.3
atlassianbitbucketRange8.1.0–8.1.3
atlassianbitbucketRange8.2.0–8.2.2
atlassianbitbucketMatch8.3.0
[
  {
    "vendor": "Atlassian",
    "product": "Bitbucket Server",
    "versions": [
      {
        "version": "7.0.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "7.6.17",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "7.7.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "7.17.10",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "7.18.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "7.21.4",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "8.0.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "8.0.3",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "8.1.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "8.1.3",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "8.2.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "8.2.2",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "8.3.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "8.3.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Atlassian",
    "product": "Bitbucket Data Center",
    "versions": [
      {
        "version": "7.0.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "7.6.17",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "7.7.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "7.17.10",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "7.18.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "7.21.4",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "8.0.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "8.0.3",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "8.1.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "8.1.3",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "8.2.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "8.2.2",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "8.3.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "8.3.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]
ParameterPositionPathDescriptionCWE
visibilityquery paramrepos?visibility=publicExploitation path uses public repos listing to locate target project/repo for later command execution (RCE vector via crafted archive request) i.e., initial step of CVE-2022-36804 exploit.CWE-78
prefixquery paramrest/api/latest/projects/{project}/repos/{file}/archiveArchive retrieval endpoint used with a crafted prefix payload to execute commands on vulnerable Bitbucket Server/Data Center instances.CWE-78
remotequery paramrest/api/latest/projects/{project}/repos/{file}/archiveArchive retrieval endpoint used with a crafted prefix payload to execute commands on vulnerable Bitbucket Server/Data Center instances.CWE-78

TheHackersNews

#Atlassian has rolled out patches for a critical vulnerability (CVE-2022-36804) in #Bitbucket Server and Data Center that could lead to the execution of malicious code on vulnerable installations. Read details: https://t.co/LLleElrOfv #infosec #hacking #cybersecurity

Har_sia

CVE-2022-36804 https://t.co/u5CkXSCCOQ #HarsiaInfo

_DrFrusci

#Atlassian has rolled out patches for a critical vulnerability (CVE-2022-36804) in #Bitbucket Server and Data Center that could lead to the execution of malicious code on vulnerable installations. Read details: https://t.co/xhxrgBVxcg #infosec #hacking #cybersecurity

eb_compliance

./KrollWire is tracking CVE-2022-36804, a vulnerability affecting #Bitbucket servers, that allows an attacker to execute arbitrary code remotely on vulnerable instances. Learn more: https://t.co/OVwBNZvvyY #cybersecurity #infosec #cyberattack

ET_Labs

28 new OPEN, 29 new PRO (28 +1) CVE-2022-36804, TA444 Domains, SocGholish and Remcos. https://t.co/EAGlSq6XTS

waiha8

Bitbucket のコートインジェクション脆弱性 / “nekono_nanomotoni on Twitter: "Atlassian社のGitツールであるBitbucketにコードインジェクションの脆弱性CVE-2022-36804/CVSS 9.9が公開されてます 発見者は9/24頃のPoC公開を予告済… /i/web/status/1565186844425199616"” https://t.co/4fA6hT7lp9

ipssignatures

It's new to me that proofpoint has a protection/signature/rule for the vulnerability CVE-2022-36804. https://t.co/jAiVQ16wvc /search?src=sprv&q=CVE-2022-36804 The vuln was published 28 days ago by NIST. #S7e3amrdm4gmgo

ipssignatures

It is the first time for me to know a protection/signature/rule for the vulnerability CVE-2022-36804. #S7e3amrdm4gmgo

shah_sheikh

CISA adds Atlassian Bitbucket Server flaw to its Known Exploited Vulnerabilities Catalog: CISA added a recently disclosed flaw in Atlassian Bitbucket Server, tracked as CVE-2022-36804, to its Known Exploited Vulnerabilities Catalog. The U.S.…

threatintelctr

NEW: CVE-2022-36804 Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from v... (click for more) Severity: HIGH https://t.co/rJ51SBafCP

Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
17 Jun 2026 04:54Current
8.9High risk
Vulners AI Score8.9
CVSS 3.18.8
EPSS0.99077
SSVC
CWE-88CWE-78In Wild
cve-2022-36804atlassianbitbucketserverdata centerrceapisecurity vulnerabilitybug bounty program
1184