Atlassian Bitbucket vulnerabilities

20 CVEs affecting Atlassian Bitbucket, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-43781, published 2022-11-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-36804: Atlassian Bitbucket Server and Data Center Command Injection Vulnerability, published 2022-08-25. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-09-30. EPSS: 99.2% chance of exploitation in the next 30 days. Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version…
CVE-2022-43781, published 2022-11-17. Critical severity, CVSS 9.8. EPSS: 98% chance of exploitation in the next 30 days. There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute…
CVE-2019-15000, published 2019-09-19. Critical severity, CVSS 9.8. EPSS: 7.8% chance of exploitation in the next 30 days. The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x ), from 6.0.0 before 6.0.10 (the fixed version for 6.0.x), from 6.1.0 before 6.1.8 (the…
CVE-2022-26136, published 2022-07-20. Critical severity, CVSS 9.8. EPSS: 5.7% chance of exploitation in the next 30 days. A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by…
CVE-2019-3397, published 2019-06-03. Critical severity, CVSS 9.1. EPSS: 4.4% chance of exploitation in the next 30 days. Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 before 5.14.4 (fixed version for 5.14.x), from 5.15.0 before…
CVE-2018-5225, published 2018-03-22. Critical severity, CVSS 9.9. EPSS: 3.4% chance of exploitation in the next 30 days. In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5…
CVE-2019-15010, published 2020-01-15. High severity, CVSS 8.8. EPSS: 2.6% chance of exploitation in the next 30 days. Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before…
CVE-2019-20097, published 2020-01-15. High severity, CVSS 8.8. EPSS: 2.5% chance of exploitation in the next 30 days. Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from…
CVE-2022-26137, published 2022-07-20. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses.…
CVE-2017-18087, published 2018-02-15. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version…

Latest

CVE-2020-36233, published 2021-02-18. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate…
CVE-2020-14171, published 2020-07-09. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the-Middle (MITM) attack.
CVE-2020-14170, published 2020-07-09. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF)…
CVE-2019-15012, published 2020-01-15. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0…