Lucene search

GitHub Advisory DatabaseGHSA-X8MF-JCMF-R79F

HistoryJun 26, 2024 - 6:30 p.m.

Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin

2024-06-2618:30:28

CWE-532

GitHub Advisory Database

github.com

bitbucket

oauth

access token

build log

branch source plugin

software

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.

Bitbucket Branch Source Plugin 887.va_d359b_3d2d8d does not include the Bitbucket OAuth access token as part of the Bitbucket URL in the build log.

Affected configurations

Vulners

Node

jenkinsbitbucket_branch_sourceRange≤886.v44cf5e4ecec5jenkins

CPENameOperatorVersion
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-sourcele886.v44cf5e4ecec5

CPE	Name	Operator	Version
	org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source	le	886.v44cf5e4ecec5

References

www.openwall.com/lists/oss-security/2024/06/26/2

github.com/advisories/GHSA-x8mf-jcmf-r79f

github.com/jenkinsci/bitbucket-branch-source-plugin/commit/ad359b3d2d8d6c114025d81abc59b3c9acb636df

nvd.nist.gov/vuln/detail/CVE-2024-39460

www.jenkins.io/security/advisory/2024-06-26/#SECURITY-3363