Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from versi
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a…
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Bitbucket Server | 7.0.0, unspecified, 7.7.0, unspecified, 7.18.0, unspecified, 8.0.0, unspecified, 8.1.0, unspecified, 8.2.0, unspecified, 8.3.0, unspecified |
| Atlassian | Bitbucket Data Center | 7.0.0, unspecified, 7.7.0, unspecified, 7.18.0, unspecified, 8.0.0, unspecified, 8.1.0, unspecified, 8.2.0, unspecified, 8.3.0, unspecified |
Yes — actively exploited. Added to the CISA KEV catalog on 2022-09-30. Ransomware use: Unknown.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection in your stack of choice:
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.