Is CVE-2022-43781 actively exploited?

CVE-2022-43781 has no public evidence of in-the-wild exploitation as of 2024-11-21.

What is the CVSS score for CVE-2022-43781?

CVE-2022-43781 has a CVSS score of 9.8 (CRITICAL severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

How do I patch CVE-2022-43781?

Patch guidance is available from atlassian security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2022-43781.

Fix CVE-2022-43781 - CRITICAL atlassian bitbucket

Q: Which products are affected by CVE-2022-43781?

8 products: atlassian bitbucket, atlassian bitbucket, atlassian bitbucket, atlassian bitbucket, atlassian bitbucket, and 3 more.

Description

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Weaknesses: CWE-77 · Command Injection CWE-77 · Command Injection

Metadata

Primary Vendor: ATLASSIAN
Published: 11/17/2022
Last Modified: 11/21/2024
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

atlassian : bitbucketatlassian : bitbucketatlassian : bitbucketatlassian : bitbucketatlassian : bitbucketatlassian : bitbucketatlassian : bitbucketatlassian : bitbucket

Remediation Guidance

Executive Summary

View on NIST NVD