Atlassian Bitbucket Server Vulnerabilities: CVEs, CISA KEV & Security Advisories

This page aggregates every publicly disclosed vulnerability (CVE) affecting Atlassian Bitbucket Server, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Affected versions and CVEs

Browse every Atlassian Bitbucket Server version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

8.0.02 CVEs
8.1.02 CVEs
>= 8.0.01 CVE
>= 8.1.01 CVE
>= 8.10.01 CVE
>= 8.11.01 CVE
>= 8.12.01 CVE
>= 8.13.01 CVE
>= 8.2.01 CVE
>= 8.3.01 CVE
>= 8.4.01 CVE
>= 8.5.01 CVE
>= 8.6.01 CVE
>= 8.7.01 CVE
>= 8.8.01 CVE
>= 8.9.01 CVE
before 7.17.121 CVE
before 7.21.61 CVE
before 7.6.191 CVE
before 8.0.51 CVE
before 8.1.51 CVE
before 8.2.41 CVE
before 8.3.31 CVE
before 8.4.21 CVE
before 8.5.01 CVE
from 3.7.0 prior to 4.14.111 CVE
from 5.0.0 prior to 5.0.91 CVE
from 5.1.0 prior to 5.1.71 CVE
from 5.1.0 prior to 5.1.81 CVE
from 5.2.0 prior to 5.2.51 CVE
from 5.2.0 prior to 5.2.61 CVE
from 5.3.0 prior to 5.3.31 CVE
from 5.3.0 prior to 5.3.41 CVE
from 5.4.0 prior to 5.4.11 CVE
from 5.4.0 prior to 5.4.21 CVE
from 5.5.0 prior to 5.5.11 CVE

Fixed in

unspecified11 CVEs
5.16.113 CVEs
6.0.113 CVEs
6.1.93 CVEs
6.2.73 CVEs
6.3.63 CVEs
6.4.43 CVEs
6.5.33 CVEs
6.6.33 CVEs
6.7.33 CVEs
6.8.23 CVEs
6.9.13 CVEs
7.17.82 CVEs
7.19.52 CVEs

Find a version

18 CVEs

Sort

High vulnerability · 2023-09-19
CVE-2023-22513
Patch
CWE-94
High · CVSS 8.5
EPSS 11.6% (94th pct)2023-09-19
Critical vulnerability · 2022-11-17
CVE-2022-43781
Public exploit
Patch
CWE-77
Critical · CVSS 9.8
EPSS 87.5% (99th pct)2022-11-17
High vulnerability · 2022-08-25
CVE-2022-36804
CISA KEV
Public exploit
Patch
CWE-78
Added to CISA KEV 2022-09-30
High · CVSS 8.7
EPSS 94.4% (100th pct)2022-08-25
High vulnerability · 2022-07-20
CVE-2022-26137
Patch
CWE-180
High · CVSS 8.8
EPSS 0.1% (31th pct)2022-07-20
Critical vulnerability · 2022-07-20
CVE-2022-26136
Patch
CWE-180
Critical · CVSS 9.8
EPSS 0.3% (55th pct)2022-07-20
Vulnerability · 2021-02-18
CVE-2020-36233
Patch
Unscored
EPSS 0.0% (12th pct)2021-02-18
Vulnerability · 2020-07-09
CVE-2020-14170
Patch
Unscored
EPSS 0.2% (42th pct)2020-07-09
Vulnerability · 2020-07-09
CVE-2020-14171
Patch
Unscored
EPSS 0.2% (47th pct)2020-07-09
Vulnerability · 2020-01-15
CVE-2019-20097
Patch
Unscored
EPSS 2.8% (87th pct)2020-01-15
Vulnerability · 2020-01-15
CVE-2019-15012
Patch
Unscored
EPSS 1.8% (83th pct)2020-01-15
Vulnerability · 2020-01-15
CVE-2019-15010
Patch
Unscored
EPSS 2.0% (84th pct)2020-01-15
Vulnerability · 2019-11-08
CVE-2019-15005
Patch
Unscored
EPSS 0.2% (44th pct)2019-11-08
Vulnerability · 2019-09-19
CVE-2019-15000
Public exploit
Patch
Unscored
EPSS 11.0% (94th pct)2019-09-19
Vulnerability · 2018-03-22
CVE-2018-5225
Patch
Unscored
EPSS 2.7% (86th pct)2018-03-22
Vulnerability · 2018-02-15
CVE-2017-18087
Patch
Unscored
EPSS 1.6% (82th pct)2018-02-15
Vulnerability · 2018-02-02
CVE-2017-18038
Patch
Unscored
EPSS 0.2% (45th pct)2018-02-02
Vulnerability · 2018-02-02
CVE-2017-18037
Patch
Unscored
EPSS 0.3% (53th pct)2018-02-02
Vulnerability · 2018-02-02
CVE-2017-18036
Patch
CWE-918
Unscored
EPSS 0.1% (35th pct)2018-02-02

Atlassian Bitbucket Server Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Specific versions

Fixed in

Common weakness types

Disclosure activity by year

Other Atlassian products

Frequently asked questions

How many CVEs does Atlassian Bitbucket Server have?

How many Atlassian Bitbucket Server CVEs are in CISA KEV?

Are there public exploits for Atlassian Bitbucket Server vulnerabilities?

Which versions of Atlassian Bitbucket Server are affected?

What are the most common weakness types in Atlassian Bitbucket Server CVEs?

How many critical Atlassian Bitbucket Server vulnerabilities are there?

What is the average severity of Atlassian Bitbucket Server CVEs?

References

Track Atlassian Bitbucket Server vulnerabilities