by Kastro
Paper/Archive/CVE-2022-26133

CVE-2022-26133

Atlassian Bitbucket Data Center — SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.1…

EPSS 71%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.4.994 × 2019.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java deserialization.

Affected

ProductAffectedFixed inSource
Bitbucket Data Center5.14.0 – < unspecifiedunspecifiedCNA
Bitbucket Data Centerunspecified – < 7.6.147.6.14CNA
Bitbucket Data Center7.7.0 – < unspecifiedunspecifiedCNA
Bitbucket Data Centerunspecified – < 7.17.67.17.6CNA
Bitbucket Data Center7.18.0 – < unspecifiedunspecifiedCNA
Bitbucket Data Centerunspecified – < 7.18.47.18.4CNA
Bitbucket Data Center7.19.0 – < unspecifiedunspecifiedCNA
Bitbucket Data Centerunspecified – < 7.19.47.19.4CNA
Bitbucket Data Center7.20.0–CNA
bitbucket_data_center5.14.0 – < 7.6.147.6.14CISA-ADP
bitbucket_data_center7.7.0 – < 7.17.67.17.6CISA-ADP
bitbucket_data_center7.18.0 – < 7.18.47.18.4CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refjira.atlassian.com/browse/BSERV-13173refconfluence.atlassian.com/security/multiple-products-security-advisory-hazelcast-vulnerable-to-remote-code-execution-cve-2016-10750-1116292387.html