CVE-2023-41937

2023-09-0612:08:57

jenkins

www.cve.org

jenkins

bitbucket

webhook

payload

credentials

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.3%

JSON

Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Jenkins Bitbucket Push and Pull Request Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "2.8.3",
        "status": "affected",
        "version": "2.4.0",
        "versionType": "maven"
      }
    ]
  }
]