Bitbucket Server / Data Center CVE-2022-36804 (command injection via repository APIs, exploitable with read access or public repos, CISA KEV): which versions are fixed and what's the interim mitigation?

What it is: CVE-2022-36804, disclosed by Atlassian on August 24, 2022 and rated critical, is a command injection flaw in several Bitbucket Server and Data Center API endpoints. Anyone who can read a repository (including anonymous users on public repositories, or any account with read permission on a private one) could run commands on the server with a crafted request. Exploitation began soon after disclosure and CISA added it to the Known Exploited Vulnerabilities catalog. Self-hosted Bitbucket servers hold source code, CI secrets and deploy keys, so they are high-value targets. Am I affected: - Self-managed Bitbucket Server and Data Center releases after 6.10.17, including 7.0.0 through 8.3.0, without the fixed maintenance release. Bitbucket Cloud (bitbucket.org) is not affected. - If Bitbucket Mesh is configured (Administration > Bitbucket Mesh), the Mesh nodes must be upgraded too. - Check the version in Administration > About, or in the page footer. Fix: 1. Upgrade to a fixed release: 7.6.17, 7.17.10 or 7.21.4 (LTS), 8.0.3, 8.1.3, 8.2.2, 8.3.1 or later. Today, move to a current supported LTS release, which also covers later vulnerabilities. Atlassian no longer ships binary patches, so the fix comes only through maintenance releases. 2. Interim mitigation per Atlassian: set feature.public.access=false in bitbucket.properties to turn off public repository access. This is not a complete fix; any user account with read access can still exploit it. 3. Keep the server off the public internet or behind SSO/VPN until patched. 4. If an affected server was reachable by untrusted users, assume compromise: check for unknown processes, files and cron jobs on the host, and new admin accounts, SSH keys and access tokens in Bitbucket; rotate repository secrets, deploy keys, CI tokens and credentials stored in or reachable from the server, and rebuild it if you find signs. Verify: Administration > About shows a fixed (preferably current LTS) version, Mesh nodes are on matching fixed versions, and public access is disabled if you relied on the mitigation. Sources: https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24-1155489835.html https://nvd.nist.gov/vuln/detail/CVE-2022-36804 https://www.cisa.gov/known-exploited-vulnerabilities-catalog