CVE-2022-36804-POC

CVE-2022-36804-POC 🕷️ Bitbucket CVE-2022-36804 unauthenticated remote command execution Exploitation Find publicly visible repositories - example.com/repos?visibility=public...

cve-2022-36804

Atlassian Bitbucket RCE PoC - CVE-2022-36804 此仓库包含 Atlassian Bitbucket 远程代码执行漏洞的简单 PoC 脚本。您可以通过以下命令直接运行此脚本： echo 'bitbucket.redacted.com' | python3 cve-2022-36804.py 或者，您可以从其他工具（如 subfinder、sublist3r 或 go-dork 等）创建目标文件： cat targets.txt | python3 cve-2022-36804.py 参考链接...

EUVD-2026-92807

h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access...

CVE-2022-36804

CVE-2022-36804 The Bitbucket Server and Bitbucket Data Center components have a command injection vulnerability, according to information recently discovered by the Sangfor security team. An attacker can submit malicious HTTP requests to execute arbitrary code and eventually get access to the...

CVE-2026-21589

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...

CVE-2026-21589

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...

CVE-2026-21589

h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access...

CVE-2026-21589

An Arbitrary File Access vulnerability exists in multiple Atlassian products, including Bitbucket , Confluence , Jira Software , Jira Service Management , Bamboo , Crowd , Crucible , and Fisheye . This flaw allows an unauthenticated remote attacker to access specific files within the web applicat...

CVE-2022-36804

CVE-2022-36804 PoC This repo contains a simple proof of concept exploit for the recent BitBucket remote code execution vulnerability CVE-2022-36804. Exploitation of this vulnerability requires access to a repository on the target instance, if you don't have creds, the target will need to have...

CVE-2022-36804-PoC

CVE-2022-36804-PoC Multithreaded exploit script for CVE-2022-36804 affecting most BitBucket versions 8.3.1 See the full advisory here https://jira.atlassian.com/browse/BSERV-13438 All credit to TheGrandPew for discovery The script will automatically detect public repositories located on bitbucket...

CVE-2022-36804

CVE-2022-36804 Atlassian Bitbucket Server 和 Data Center 命令注入漏洞 CVE-2022-36804 在受影响的 Atlassian Bitbucket Server 和 Data Center 版本中，多个 API 端点存在命令注入漏洞，攻击者若能访问公共仓库或拥有私有 Bitbucket 仓库的读取权限，可通过发送恶意 HTTP 请求执行任意代码。 漏洞目标搭建 docker pull atlassian/bitbucket-server:7.2.5-ubuntu-jdk11 docker run -v...

CVE-2022-36804

CVE-2022-36804 - Atlassian Bitbucket Server and Data Center Command Injection Vulnerability ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author Walnut Security Services Pvt. Ltd Description Multiple API endpoints in...

Atlassian-Bitbucket-CVE-2022-36804

Atlassian-Bitbucket-Server-CVE-2022-36804 A critical command injection vulnerability was found in multiple API endpoints of the Atlassian Bit bucket Server and Data center. This vulnerability affects all versions of Bitbucket Server and Data Center released before versions &...

Snyk Scan

Bitbucket Pipelines Pipe: Snyk This pipe uses Snyk to find, fix and monitor known vulnerabilities in your app dependencies and docker image. YAML Definition Add the following snippet to the script section of your bitbucket-pipelines.yml file: - pipe: snyk/snyk-scan:1.0.2 variables: SNYKTOKEN: ""...

Atlassian Jira < 9.12.40 / 10.3.x < 10.3.26 / 11.3.x < 11.3.12 (JRASERVER-79546)

The version of Atlassian Jira Server running on the remote host is affected by a vulnerability as referenced in the JRASERVER-79546 advisory. - h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center,...

Atlassian Jira Service Management Data Center and Server < 5.12.40 / 10.3.x < 10.3.26 / 11.3.x < 11.3.12 (JSDSERVER-16809)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16809 advisory. - h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service...

PT-2026-106255

Name of the Vulnerable Software and Affected Versions Bitbucket Data Center versions 4.6.0 through 9.4.25 Bitbucket Data Center versions 10.2.0 through 10.2.7 Bitbucket Data Center versions 10.5.0 through 10.5.0 Confluence Data Center versions 5.10.0 through 9.2.25 Confluence Data Center versions...

CVE-2022-36804-Bitbucket-RCE-Analysis

CVE-2022-36804: Bitbucket 远程命令执行 RCE 空字节参数注入的技术分析与实验室利用 漏洞概要 CVE-2022-36804 是 Atlassian Bitbucket Server 和 Data Center 的 REST API 中的一个高危/严重 参数注入 漏洞。 虽然官方 NVD 国家漏洞数据库的基础评分为 8.8（高危） ，基于需要读取权限 PR:L 的假设，但本分析将其视为 9.8（严重） 漏洞 PR:N。如果目标仓库启用了公共访问（一种常见配置），则利用向量完全变为未经身份验证。 本仓库记录了该漏洞利用的完整链式实验室复现，直接基于 Assetno...

sonarcloud-scan

Bitbucket Pipelines Pipe: SonarQube Cloud scan Scan your code with SonarQube Cloud to detects bugs, vulnerabilities and code smells in more than 25 programming languages. Your SonarCloud account must first be associated to your Bitbucket team or user account. SonarQube Cloud is totally free for...

bitbucket-test

Docker 容器用于研究 CVE-2022-36804 重现一个远程代码执行漏洞，其中 Bitbucket 未能对用户输入进行清理，从而使攻击者能够注入 Git 标志并远程执行代码。 本仓库记录了我如何复现漏洞 CVE-2022-36804，即 Bitbucket Server 中预认证参数注入的问题。目标是按照 Assetnote 的公开文章所述，演示底层安全问题。所有测试均在隔离的本地环境中进行。 概述 CVE-2022-36804 是由于 Bitbucket 将用户输入直接传递给 git archive 子进程，而未对空字节进行清理所致。由于 Bitbucket 使用...