Sploitus

CVE-2022-36804

24 known exploits for CVE-2022-36804

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Affected products
Bitbucket, Bitbucket Server
Atlassian Bitbucket
< 7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.3, 8.2.2, 8.3.0
Fix
Available
CVSS 3.1
8.8 HIGH
EPSS
99.1% (100th percentile)
Weakness
CWE-88, CWE-78
NVD status
Analyzed
Published
2022-08-25
CVE-2022-36804 at NVD
Authoritative description, scoring and affected products

24 known exploits for CVE-2022-36804

Proof-of-concept code and exploit modules indexed by Sploitus

Exploit for OS Command Injection in Atlassian Bitbucket
2026-08-21 JunoheaGITHUB
Exploit for Argument Injection in Atlassian Bitbucket
2026-02-26 DanielHallbroGITHUB
Exploit for Argument Injection in Atlassian Bitbucket
2025-01-30 asepsaepdinGITHUB
Bitbucket 7.0.0 Remote Command Execution
2023-03-24 khal4n1PACKETSTORM
Bitbucket v7.0.0 - Remote Code Execution Exploit
2023-03-23 khal4n1ZDTPython
Bitbucket v7.0.0 - RCE
2023-03-23 khal4n1EXPLOITDBPython
Exploit for Argument Injection in Atlassian Bitbucket
2023-02-02 imbas007GITHUB
Exploit for Argument Injection in Atlassian Bitbucket
2023-01-23 walnutsecurityGITHUB
Exploit for Argument Injection in Atlassian Bitbucket
2022-10-04 ColdFusionXGITHUB
Exploit for Argument Injection in Atlassian Bitbucket
2022-09-26 Inplex-sysGITHUB
Exploit for Argument Injection in Atlassian Bitbucket
2022-09-26 SystemVllGITHUB
Exploit for Argument Injection in Atlassian Bitbucket
2022-09-25 tahtaciburakGITHUB
Exploit for Argument Injection in Atlassian Bitbucket
2022-09-24 khal4n1GITHUB
Bitbucket Git Command Injection Exploit
2022-09-23 metasploitZDTRuby
Exploit for Argument Injection in Atlassian Bitbucket
2022-09-23 ChocapikkGITHUB
Bitbucket Git Command Injection
2022-09-22 Ron Bowes, Shelby Pace, Jang, TheGrandPew, metasploit.comPACKETSTORMRuby
Exploit for Argument Injection in Atlassian Bitbucket
2022-09-21 kljunowskyGITHUB
Exploit for Argument Injection in Atlassian Bitbucket
2022-09-20 JRandomSageGITHUB
Exploit for Argument Injection in Atlassian Bitbucket
2022-09-20 BenHays142GITHUB
Exploit for Argument Injection in Atlassian Bitbucket
2022-09-20 benjaminhaysGITHUB
Exploit for Argument Injection in Atlassian Bitbucket
2022-09-20 fed-speakGITHUB
Exploit for Argument Injection in Atlassian Bitbucket
2022-09-19 notxeshGITHUB
Exploit for Argument Injection in Atlassian Bitbucket
2022-09-07 notdlsGITHUB
Bitbucket Git Command Injection
2022-08-24 TheGrandPew, Ron Bowes, Jang, Shelby PaceMETASPLOITRuby