According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is affected by a command injection vulnerability. A remote attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled "Allow public signup".

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Bitbucket installed on the remote host 7.0.0 prior to 7.6.19, 7.7.0 prior to 7.17.12, 7.18.0 prior to 7.21.6, 8.0 prior to 8.0.5, 8.1 prior to 8.1.5, 8.2 prior to 8.2.4, 8.3 prior to 8.3.3 or 8.4 prior to 8.4.2. It is, therefore, affected by a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to gain code execution and execute code on the system.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is is prior to version 6.6.0. It is, therefore, shipped with a vulnerable version of the Atlassian Troubleshooting and Support plugin (ATST), which permitted unprivileged users to initialte log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
113446	Atlassian Bitbucket 8.4.x < 8.4.2 Command Injection	Web App Scanning	Component Vulnerability	11/24/2022	3/14/2023	critical
113440	Atlassian Bitbucket 7.7.x < 7.17.12 Command Injection	Web App Scanning	Component Vulnerability	11/24/2022	3/14/2023	critical
113441	Atlassian Bitbucket 7.18.x < 7.21.6 Command Injection	Web App Scanning	Component Vulnerability	11/24/2022	3/14/2023	critical
170143	Atlassian Bitbucket < 7.6.19 / 7.17.12 / 7.21.6 / 8.0.5 / 8.1.5 / 8.2.4 / 8.3.3 / 8.4.2 Command Injection	Nessus	CGI abuses	1/18/2023	11/22/2024	critical
113444	Atlassian Bitbucket 8.2.x < 8.2.4 Command Injection	Web App Scanning	Component Vulnerability	11/24/2022	3/14/2023	critical
113445	Atlassian Bitbucket 8.3.x < 8.3.3 Command Injection	Web App Scanning	Component Vulnerability	11/24/2022	3/14/2023	critical
113724	Atlassian Bitbucket < Improper Authorization Leakage Via ATST Plugin	Web App Scanning	Component Vulnerability	3/14/2023	3/14/2023	critical
113439	Atlassian Bitbucket < 7.6.19 Command Injection	Web App Scanning	Component Vulnerability	11/24/2022	3/14/2023	critical
113442	Atlassian Bitbucket 8.0.x < 8.0.5 Command Injection	Web App Scanning	Component Vulnerability	11/24/2022	3/14/2023	critical
113443	Atlassian Bitbucket 8.1.x < 8.1.5 Command Injection	Web App Scanning	Component Vulnerability	11/24/2022	3/14/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical