Atlassian fixes critical vulnerability in Bitbucket Server and data center

Australian software company Atlassian has released fixes to address a critical vulnerability in Bitbucket Server and Data Center.

The vulnerability, identified as CVE-2022-36804, has a severity of 9.9 and could grant attacker access to execute malicious code on vulnerable installations.

Further investigation shows that the problem is a command injection vulnerability in multiple endpoints that could be exploited via specially crafted HTTP requests.

The bug affects all versions of Bitbucket Server, and Datacenter released after 6.10.17, including Bitbucket Server and Datacenter 7.0.0, Bitbucket Server and Datacenter 7.6, Bitbucket Server and Datacenter 7.17, Bitbucket Server and Datacenter 7.21, Bitbucket Server and Datacenter 8.0, Bitbucket Server and Datacenter 8.1, Bitbucket Server and Datacenter 8.2, and Bitbucket Server and Datacenter 8.3.

Users of affected versions are advised to upgrade their instances to the latest version as soon as possible to mitigate potential threats.

For those who are unable to apply the patches immediately, Atlassian has also provided a temporary workaround. This involves turning off public repositories using “features.public.access=false” to prevent unauthorized users from exploiting the vulnerability.

The sources for this piece include an article in TheHackerNews.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web