Not rated
CVE-2022-20619 A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and…
Description
A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Bitbucket Branch Source Plugin 737 | earliest → 737.vdf9dc06105be | No fix stated |
| Jenkins Bitbucket Branch Source Plugin 725 | earliest → < 725.vd9f8be0fa250 | 725.vd9f8be0fa250 |
| Jenkins Bitbucket Branch Source Plugin 2.9 | earliest → < 2.9.11.2 | 2.9.11.2 |
References
- www.jenkins.io www.jenkins.io
- [oss-security] 20220112 Multiple vulnerabilities in Jenkins and Jenkins plugins www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Jenkins Bitbucket Branch Source Plugin
The 4 CVEs of Jenkins Bitbucket Branch Source Plugin →
CVE-2024-39460
Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part…
4.3
Medium
CVE-2024-28152
In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when…
6.3
Medium
CVE-2022-20618
A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with…
Not rated