Skip to content
Sign in
Not rated

CVE-2023-41937 Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the…

Description

Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.

Affected products and versions

Product Affected versions Fixed in
Jenkins Bitbucket Push and Pull Request Plugin 2.4 2.4.0 → 2.8.3 No fix stated

Other CVEs of Jenkins Bitbucket Push and Pull Request Plugin

The 3 CVEs of Jenkins Bitbucket Push and Pull Request Plugin →
CVE-2026-92139 Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload,… 6.5 Medium CVE-2026-57289 Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and… 4.8 Medium
Track this CVE