CVE-2022-43781

—

CVSS 3.1

9.8 critical

EPSS

98%p100

Published

Nov 17, 2022 (Nov 17, 2022)

Modified

Jun 17, 2026

Description

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.

Vendors: atlassian
Products: bitbucket
Weakness: CWE-77
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (98.1%)

In the news4 stories

Atlassian's Jira Service Management Found Vulnerable to Critical Vulnerability

The Hacker NewsFeb 4, 02:29 UTC · Feb 4, 2023Vulnerability CVE-2023-22501 CVE-2022-43781 CVE-2022-43782

Atlassian fixed critical authentication vulnerability in Jira Software

Security AffairsFeb 3, 13:29 UTC · Feb 3, 2023Vulnerability CVE-2023-22501 CVE-2022-43781

Atlassian Releases Patches for Critical Flaws Affecting Crowd and Bitbucket Products

The Hacker NewsNov 19, 04:30 UTC · Nov 19, 2022Vulnerability in the wildCVE-2022-43781 CVE-2022-43782 CVE-2022-36804

Atlassian fixed 2 critical flaws in Crowd and Bitbucket products

Security AffairsNov 18, 21:35 UTC · Nov 18, 2022Vulnerability CVE-2022-43781 CVE-2022-43782