{"api_version":"1","generated_at":"2026-04-23T00:42:16+00:00","cve":"CVE-2022-43781","urls":{"html":"https://cve.report/CVE-2022-43781","api":"https://cve.report/api/cve/CVE-2022-43781.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-43781","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-43781"},"summary":{"title":"CVE-2022-43781","description":"There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.","state":"PUBLIC","assigner":"security@atlassian.com","published_at":"2022-11-17 00:15:00","updated_at":"2022-11-18 18:51:00"},"problem_types":["CWE-77"],"metrics":[],"references":[{"url":"https://confluence.atlassian.com/x/Y4hXRg","name":"https://confluence.atlassian.com/x/Y4hXRg","refsource":"MISC","tags":[],"title":"Bitbucket Server and Data Center Security Advisory 2022-11-16 | Bitbucket Data Center and Server 8.6 | Atlassian Documentation","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://jira.atlassian.com/browse/BSERV-13522","name":"https://jira.atlassian.com/browse/BSERV-13522","refsource":"MISC","tags":[],"title":"[BSERV-13522] Critical severity command injection vulnerability - CVE-2022-43781 - Create and track feature requests for Atlassian products.","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43781","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43781","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"43781","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"bitbucket","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-43781","qid":"150596","title":"Atlassian Bitbucket Server and Data Center: Command Injection Vulnerability (CVE-2022-43781)"},{"cve":"CVE-2022-43781","qid":"730671","title":"Atlassian Bitbucket Server and Data Center Command Injection Vulnerability"}]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2022-43781","ASSIGNER":"security@atlassian.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"RCE (Remote Code Execution)"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Atlassian","product":{"product_data":[{"product_name":"Bitbucket Data Center","version":{"version_data":[{"version_value":"before 7.0","version_affected":"!"},{"version_value":"before 7.17.12","version_affected":"="},{"version_value":"before 7.21.6","version_affected":"="},{"version_value":"before 7.6.19","version_affected":"="},{"version_value":"before 8.0.5","version_affected":"="},{"version_value":"before 8.1.5","version_affected":"="},{"version_value":"before 8.2.4","version_affected":"="},{"version_value":"before 8.3.3","version_affected":"="},{"version_value":"before 8.4.2","version_affected":"="},{"version_value":"before 8.5.0","version_affected":"="}]}},{"product_name":"Bitbucket Server","version":{"version_data":[{"version_value":"before 7.0","version_affected":"!"},{"version_value":"before 7.17.12","version_affected":"="},{"version_value":"before 7.21.6","version_affected":"="},{"version_value":"before 7.6.19","version_affected":"="},{"version_value":"before 8.0.5","version_affected":"="},{"version_value":"before 8.1.5","version_affected":"="},{"version_value":"before 8.2.4","version_affected":"="},{"version_value":"before 8.3.3","version_affected":"="},{"version_value":"before 8.4.2","version_affected":"="},{"version_value":"before 8.5.0","version_affected":"="}]}}]}}]}},"references":{"reference_data":[{"url":"https://confluence.atlassian.com/x/Y4hXRg","refsource":"MISC","name":"https://confluence.atlassian.com/x/Y4hXRg"},{"url":"https://jira.atlassian.com/browse/BSERV-13522","refsource":"MISC","name":"https://jira.atlassian.com/browse/BSERV-13522"}]},"credits":[{"lang":"en","value":"https://github.com/Ry0taK"}]},"nvd":{"publishedDate":"2022-11-17 00:15:00","lastModifiedDate":"2022-11-18 18:51:00","problem_types":["CWE-77"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*","versionStartIncluding":"8.4.0","versionEndExcluding":"8.4.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.6.19","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*","versionStartIncluding":"7.7.0","versionEndExcluding":"7.17.12","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*","versionStartIncluding":"7.18.0","versionEndExcluding":"7.21.6","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*","versionStartIncluding":"8.1.0","versionEndExcluding":"8.1.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*","versionStartIncluding":"8.2.0","versionEndExcluding":"8.2.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*","versionStartIncluding":"8.3.0","versionEndExcluding":"8.3.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*","versionStartIncluding":"7.22.0","versionEndExcluding":"8.0.5","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}