Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

PRP: Request Atlassian Bitbucket Server and Data Center RCE (CVE-2022-36804) #266

Open
SuperX-SIR opened this issue Sep 5, 2022 · 1 comment · May be fixed by #267
Open

PRP: Request Atlassian Bitbucket Server and Data Center RCE (CVE-2022-36804) #266

SuperX-SIR opened this issue Sep 5, 2022 · 1 comment · May be fixed by #267
Assignees
@SuperX-SIR
Labels
Contributor main The main issue a contributor is working on (top of the contribution queue). PRP:Accepted PRP:Inactive

Comments

@SuperX-SIR
Copy link

SuperX-SIR commented Sep 5, 2022 •
edited

Hello.
I want to contribute to the tsunami scanner with a detector plugin to detect CVE-2022-36804 vulnerability

Reference

https://nvd.nist.gov/vuln/detail/CVE-2022-36804
https://jira.atlassian.com/browse/BSERV-13438
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36804

Description

The vulnerability has been assigned a CVE ID CVE-2022-36804 , the severity level of the vulnerability is Critical : CVSS v3 score: 9.9 => Critical severityhttps://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

There is a command injection vulnerability in multiple API endpoints of Bitbucket Server and Data Center. An attacker with access to a public Bitbucket repository（remote, unauthenticated attacker ） or with read permissions to a private one can execute arbitrary code by sending a malicious HTTP request.

versions

All versions released after 6.10.17 including 7.0.0 and newer are affected, this means that all instances that are running any versions between 7.0.0 and 8.3.0 inclusive can be exploited by this vulnerability.
@maoning
Copy link
Collaborator

maoning commented Sep 13, 2022

Hi @SuperX-SIR ,

Thanks for your request! This vulnerability is in scope for the reward program. Please submit our participation form and you can start working on the development.

Please keep in mind that the Tsunami Scanner Team will only be able to work at one issue at a time for each participant so please hold on the implementation work for any other requests you might have.

Thanks!

@SuperX-SIR SuperX-SIR linked a pull request Sep 16, 2022 that will close this issue
Open
@tooryx tooryx added the Contributor main The main issue a contributor is working on (top of the contribution queue). label Feb 1, 2024
@tooryx tooryx linked a pull request Feb 1, 2024 that will close this issue
add CVE-2022-36804 Detector #267
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@SuperX-SIR SuperX-SIR

Labels
Contributor main The main issue a contributor is working on (top of the contribution queue). PRP:Accepted PRP:Inactive
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

add CVE-2022-36804 Detector SuperX-SIR/tsunami-security-scanner-plugins
3 participants
@tooryx @maoning @SuperX-SIR