Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2023-22513: This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score o...
CVE-2023-22513 · published 3 years ago
Summary
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidential...
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| atlassian | bitbucket_data_center |
>= 8.9.0, < 8.9.5 >= 8.10.0, < 8.10.5 >= 8.11.0, < 8.11.4 >= 8.12.0, < 8.12.2 8.13.0 cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:* |
| atlassian | bitbucket_server |
>= 8.9.0, < 8.9.5 >= 8.10.0, < 8.10.5 >= 8.11.0, < 8.11.4 >= 8.12.0, < 8.12.2 8.13.0 cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:* |
Original advisory text
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score o...
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Bitbucket Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Bitbucket Data Center and Server 8.9: Upgrade to a release greater than or equal to 8.9.5 Bitbucket Data Center and Server 8.10: Upgrade to a release greater than or equal to 8.10.5 Bitbucket Data Center and Server 8.11: Upgrade to a release greater than or equal to 8.11.4 Bitbucket Data Center and Server 8.12: Upgrade to a release greater than or equal to 8.12.2 Bitbucket Data Center and Server 8.13: Upgrade to a release greater than or equal to 8.13.1 Bitbucket Data Center and Server 8.14: Upgrade to a release greater than or equal to 8.14.0 Bitbucket Data Center and Server version >= 8.0 and < 8.9: Upgrade to any of the listed fix versions. See the release notes (https://confluence.atlassian.com/bitbucketserver/release-notes). You can download the latest version of Bitbucket Data Center and Server from the download center (https://www.atlassian.com/software/bitbucket/download-archives). This vulnerability was discovered by a private user and reported via our Bug Bounty program
References
- https://confluence.atlassian.com/pages/viewpage.action?pageId=1283691616 Vendor Advisory
- https://jira.atlassian.com/browse/BSERV-14419 Issue Tracking Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-94Code Injection
Timeline
Published19 Sep 2023
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2023-22513 · NVD
Track software like this
Free during beta