Read the docs
TI-2023-08755 Aliases CVE-2023-22513GHSA-3f2j-57ff-r6p5

Code injection in Atlassian Bitbucket Data Center

Priority MEDIUM 56CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Bitbucket Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Bitbucket Data Center and Server 8.9: Upgrade to a release greater than or equal to 8.9.5 Bitbucket Data Center and Server 8.10: Upgrade to a release greater than or equal to 8.10.5 Bitbucket Data Center and Server 8.11: Upgrade to a release greater than or equal to 8.11.4 Bitbucket Data Center and Server 8.12: Upgrade to a release greater than or equal to 8.12.2 Bitbucket Data Center and Server 8.13: Upgrade to a release greater than or equal to 8.13.1 Bitbucket Data Center and Server 8.14: Upgrade to a release greater than or equal to 8.14.0 Bitbucket Data Center and Server version >= 8.0 and < 8.9: Upgrade to any of the listed fix versions. See the release notes (https://confluence.atlassian.com/bitbucketserver/release-notes). You can download the latest version of Bitbucket Data Center and Server from the download center (https://www.atlassian.com/software/bitbucket/download-archives). This vulnerability was discovered by a private user and reported via our Bug Bounty program

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.15279 96th percentileScored 2026-11-07
Fix Fixed Bitbucket Data Center (Atlassian): < 8.0.0, >= 8.10.5, >= 8.11.4 +4Bitbucket Server (Atlassian): < 8.0.0, >= 8.10.5, >= 8.11.4 +4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianBitbucket Data Center>= 8.0.0; >= 8.1.0; >= 8.10.0; >= 8.11.0; >= 8.12.0; >= 8.13.0; >= 8.2.0; >= 8.3.0; >= 8.4.0; >= 8.5.0; >= 8.6.0; >= 8.7.0; >= 8.8.0; >= 8.9.0< 8.0.0, >= 8.10.5, >= 8.11.4, >= 8.12.2, >= 8.13.1, >= 8.14.0, >= 8.9.5Patch availableCNA
AtlassianBitbucket Server>= 8.0.0; >= 8.1.0; >= 8.10.0; >= 8.11.0; >= 8.12.0; >= 8.13.0; >= 8.2.0; >= 8.3.0; >= 8.4.0; >= 8.5.0; >= 8.6.0; >= 8.7.0; >= 8.8.0; >= 8.9.0< 8.0.0, >= 8.10.5, >= 8.11.4, >= 8.12.2, >= 8.13.1, >= 8.14.0, >= 8.9.5Patch availableCNA
  • Bitbucket Data Center VendorAtlassian Affected >= 8.0.0; >= 8.1.0; >= 8.10.0; >= 8.11.0; >= 8.12.0; >= 8.13.0; >= 8.2.0; >= 8.3.0; >= 8.4.0; >= 8.5.0; >= 8.6.0; >= 8.7.0; >= 8.8.0; >= 8.9.0 Fixed in < 8.0.0, >= 8.10.5, >= 8.11.4, >= 8.12.2, >= 8.13.1, >= 8.14.0, >= 8.9.5 Patch available CNA
  • Bitbucket Server VendorAtlassian Affected >= 8.0.0; >= 8.1.0; >= 8.10.0; >= 8.11.0; >= 8.12.0; >= 8.13.0; >= 8.2.0; >= 8.3.0; >= 8.4.0; >= 8.5.0; >= 8.6.0; >= 8.7.0; >= 8.8.0; >= 8.9.0 Fixed in < 8.0.0, >= 8.10.5, >= 8.11.4, >= 8.12.2, >= 8.13.1, >= 8.14.0, >= 8.9.5 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*8.9.0 to before 8.9.5; 8.10.0 to before 8.10.5; 8.11.0 to before 8.11.4; 8.12.0 to before 8.12.2VulnerableAtlassian
cpe:2.3:a:atlassian:bitbucket_data_center:8.13.0:*:*:*:*:*:*:*8.13.0VulnerableAtlassian
cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:*8.9.0 to before 8.9.5; 8.10.0 to before 8.10.5; 8.11.0 to before 8.11.4; 8.12.0 to before 8.12.2VulnerableAtlassian
cpe:2.3:a:atlassian:bitbucket_server:8.13.0:*:*:*:*:*:*:*8.13.0VulnerableAtlassian
  • cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:* Versions 8.9.0 to before 8.9.5; 8.10.0 to before 8.10.5; 8.11.0 to before 8.11.4; 8.12.0 to before 8.12.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bitbucket_data_center:8.13.0:*:*:*:*:*:*:* Versions 8.13.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:* Versions 8.9.0 to before 8.9.5; 8.10.0 to before 8.10.5; 8.11.0 to before 8.11.4; 8.12.0 to before 8.12.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bitbucket_server:8.13.0:*:*:*:*:*:*:* Versions 8.13.0 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Bitbucket Data Center (Atlassian) Fixed in < 8.0.0, >= 8.10.5, >= 8.11.4, >= 8.12.2, >= 8.13.1, >= 8.14.0, >= 8.9.5
  • Fix · CNA Bitbucket Server (Atlassian) Fixed in < 8.0.0, >= 8.10.5, >= 8.11.4, >= 8.12.2, >= 8.13.1, >= 8.14.0, >= 8.9.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-22513
  2. 2026-10-03 Alias added: GHSA-3f2j-57ff-r6p5

References

Advisory 2

  • TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
  • TI-2022-09595 Deserialization of untrusted data in Atlassian Bitbucket Data Center CVSS 3.1CRITICAL 9.8
  • TI-2024-14400 Open redirect in Atlassian Bitbucket Data Center CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences