7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
37.0%
Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.
CPE | Name | Operator | Version |
---|---|---|---|
jenkins:bitbucket_push_and_pull_request | jenkins bitbucket push and pull request | le | 2.8.3 |
[
{
"defaultStatus": "unaffected",
"product": "Jenkins Bitbucket Push and Pull Request Plugin",
"vendor": "Jenkins Project",
"versions": [
{
"lessThanOrEqual": "2.8.3",
"status": "affected",
"version": "2.4.0",
"versionType": "maven"
}
]
}
]