CVE-2022-28133

Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to create BitBucket Server consumers...

CVE-2021-39871

In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed by an attacker making a crafted API call...

DoS (Denial of Service) Third-Party Dependency in Bitbucket Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 8.9.4, 8.13.4, 8.14.3, 8.15.2, 8.16.0, 8.17.0, 8.18.0, 8.19.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bitbucket Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score o...

Jenkins Bitbucket Server Integration Plugin CSRF

The vulnerability of the Jenkins Bitbucket Server Integration Plugin is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack using a specially created URL address...

Bitbucket Server Integration Plugin allows bypassing CSRF protection for any URL

An extension point in Jenkins allows selectively disabling cross-site request forgery CSRF protection for specific URLs. Bitbucket Server Integration Plugin implements this extension point to support OAuth 1.0 authentication. In Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusi...

GHSA-QJW6-XVRM-5F2H Bitbucket Server Integration Plugin allows bypassing CSRF protection for any URL

An extension point in Jenkins allows selectively disabling cross-site request forgery CSRF protection for specific URLs. Bitbucket Server Integration Plugin implements this extension point to support OAuth 1.0 authentication. In Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusi...

io.jenkins.plugins:bitbucket-kubernetes-credentials (>=202.v15b_72a_698524, <=467.vdffa_a_9249dc5) potentially affected by CVE-2025-24398 via io.jenkins.plugins:atlassian-bitbucket-server-integration (>=3.4.2, <=4.1.1)

io.jenkins.plugins:atlassian-bitbucket-server-integration MAVEN version =3.4.2, =202.v15b72a698524, =467.vdffaa9249dc5 Source cves: CVE-2025-24398 Source advisory: OSV:GHSA-QJW6-XVRM-5F2H...

io.jenkins.plugins:bitbucket-kubernetes-credentials (>=202.v15b_72a_698524, <=467.vdffa_a_9249dc5) potentially affected by CVE-2025-24398 via io.jenkins.plugins:atlassian-bitbucket-server-integration (>=3.4.2, <=4.1.1)

io.jenkins.plugins:atlassian-bitbucket-server-integration MAVEN version =3.4.2, =202.v15b72a698524, =467.vdffaa9249dc5 Source cves: CVE-2025-24398 Source advisory: GHSA-QJW6-XVRM-5F2H...

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

CVE-2025-24398

The Jenkins Bitbucket Server Integration Plugin versions 2.1.0 through 4.1.3 (both inclusive) is vulnerable to a Cross-Site Request Forgery (CSRF) bypass . The root cause is an overly permissive implementation of a Jenkins extension point used to support OAuth 1.0 authentication, which selectivel...

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

io.jenkins.plugins:bitbucket-kubernetes-credentials (>=202.v15b_72a_698524, <=467.vdffa_a_9249dc5) potentially affected by CVE-2025-24398 via io.jenkins.plugins:atlassian-bitbucket-server-integration (>=3.4.2, <=4.1.1)

io.jenkins.plugins:atlassian-bitbucket-server-integration MAVEN version =3.4.2, =202.v15b72a698524, =467.vdffaa9249dc5 Source cves: CVE-2025-24398 Source advisory: MEND:CVE-2025-24398...

Jenkins Plugin: Bitbucket Server Integration – Cross-Site Request Forgery Vulnerability

Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A security vulnerability in...

PT-2025-5356 · Jenkins · Jenkins Bitbucket Server Integration Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Bitbucket Server Integration Plugin versions 2.1.0 through 4.1.3 Description: The issue allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. This is due to an overly permissive...

CVE-2025-24398: Cross-Site Request Forgery (CSRF)

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

Path Traversal org.springframework:spring-webmvc Dependency in Bitbucket Data Center and Server

This High severity org.springframework:spring-webmvc vulnerability exists in 8.9.0 - 8.9.23 and 8.19.0 to 8.19.12 of Bitbucket Data Center and Server. This org.springframework:spring-webmvc Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

DoS (Denial of Service) org.apache.cxf:cxf-rt-rs-security-jose Dependency in Bitbucket Data Center and Server

This High severity org.apache.cxf:cxf-rt-rs-security-jose Dependency vulnerability was introduced in versions 8.9.0, 8.18.0, and 8.19.0 of Bitbucket Data Center and Server. This org.apache.cxf:cxf-rt-rs-security-jose Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...