← back
CVE-2022-26133

CVE-2022-26133

CVSS 9.8 CRITICALEPSS 71.4%CWE-502
SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java deserialization.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Atlassian · Bitbucket Data Center
public PoCs found — 2
githubgithub.com/Pear1y/CVE-2022-26133★ 147githubgithub.com/abbarhissarh/CVE-2022-26133★ 3
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://confluence.atlassian.com/security/multiple-products-security-advisory-hazelcast-vulnerable-to-remote-code-execution-cve-2016-10750-1116292387.htmlhttps://jira.atlassian.com/browse/BSERV-13173