CVE-2022-43781

2022-11-1700:15:18

CWE-77

[email protected]

web.nvd.nist.gov

cve-2022-43781

environment variables

bitbucket server

data center

permission control

arbitrary code

unauthenticated

allow public signup

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.57 Medium

EPSS

Percentile

97.7%

JSON

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.