Lucene search
PRIOn knowledge basePRION:CVE-2023-41937HistorySep 06, 2023 - 1:15 p.m.
Design/Logic Flaw
2023-09-0613:15:00
PRIOn knowledge base
www.prio-n.com
5
jenkins
bitbucket
plugin
webhook
payload
credentials
attackers
nvd
0.001 Low
EPSS
Percentile
37.3%
Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.
| CPE | Name | Operator | Version |
|---|---|---|---|
| bitbucket_push_and_pull_request | ge | 2.4.0 | |
| bitbucket_push_and_pull_request | le | 2.8.3 |
Related
cvelist
cvelist
CVE-2023-41937
2023-09-06 12:08:57
cve
cve
CVE-2023-41937
2023-09-06 13:15:10
github
github
osv
osv
nvd
nvd
CVE-2023-41937
2023-09-06 13:15:10
nessus
nessus
Jenkins plugins Multiple Vulnerabilities (2023-09-06)
2023-09-07 00:00:00