{"id":"CVE-2022-43781","url":"https://www.cyber-defence.io/tools/cve/CVE-2022-43781","generatedAt":"2026-11-04T23:56:24.536Z","title":"There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center.","description":"There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.","published":"2022-11-17T00:15:18.000Z","lastModified":"2026-06-17T05:07:20.000Z","status":"Modified","sourceIdentifier":"security@atlassian.com","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-77"],"affected":["atlassian/bitbucket"],"epss":{"score":0.98035,"percentile":0.9991,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 98.0%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://confluence.atlassian.com/x/Y4hXRg","tags":["Mitigation","Release Notes","Vendor Advisory"],"source":"security@atlassian.com"},{"url":"https://jira.atlassian.com/browse/BSERV-13522","tags":["Issue Tracking","Patch","Vendor Advisory"],"source":"security@atlassian.com"},{"url":"https://confluence.atlassian.com/x/Y4hXRg","tags":["Mitigation","Release Notes","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://jira.atlassian.com/browse/BSERV-13522","tags":["Issue Tracking","Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-43781","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}