CVE-2022-43781
CRITICALBitbucket Server/Data Center - Command Injection
Title source: llmDescription
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.
Exploits (1)
metasploit
WORKING POC
EXCELLENT
by Ry0taK, y4er, Shelby Pace · rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/bitbucket_env_var_rce.rb
Scores
CVSS v3
9.8
EPSS
0.8824
EPSS Percentile
99.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-77
Status
published
Products (1)
atlassian/bitbucket
7.0.0 - 7.6.19
Published
Nov 17, 2022
Tracked Since
Feb 18, 2026