DoS (Denial of Service) Third-Party Dependency in Bitbucket Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 8.9.4, 8.13.4, 8.14.3, 8.15.2, 8.16.0, 8.17.0, 8.18.0, 8.19.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bitbucket Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score o...

Jenkins Bitbucket Server Integration Plugin CSRF

The vulnerability of the Jenkins Bitbucket Server Integration Plugin is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack using a specially created URL address...

GHSA-QJW6-XVRM-5F2H Bitbucket Server Integration Plugin allows bypassing CSRF protection for any URL

An extension point in Jenkins allows selectively disabling cross-site request forgery CSRF protection for specific URLs. Bitbucket Server Integration Plugin implements this extension point to support OAuth 1.0 authentication. In Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusi...

io.jenkins.plugins:bitbucket-kubernetes-credentials (>=202.v15b_72a_698524, <=467.vdffa_a_9249dc5) potentially affected by CVE-2025-24398 via io.jenkins.plugins:atlassian-bitbucket-server-integration (>=3.4.2, <=4.1.1)

io.jenkins.plugins:atlassian-bitbucket-server-integration MAVEN version =3.4.2, =202.v15b72a698524, =467.vdffaa9249dc5 Source cves: CVE-2025-24398 Source advisory: OSV:GHSA-QJW6-XVRM-5F2H...

io.jenkins.plugins:bitbucket-kubernetes-credentials (>=202.v15b_72a_698524, <=467.vdffa_a_9249dc5) potentially affected by CVE-2025-24398 via io.jenkins.plugins:atlassian-bitbucket-server-integration (>=3.4.2, <=4.1.1)

io.jenkins.plugins:atlassian-bitbucket-server-integration MAVEN version =3.4.2, =202.v15b72a698524, =467.vdffaa9249dc5 Source cves: CVE-2025-24398 Source advisory: GHSA-QJW6-XVRM-5F2H...

Bitbucket Server Integration Plugin allows bypassing CSRF protection for any URL

An extension point in Jenkins allows selectively disabling cross-site request forgery CSRF protection for specific URLs. Bitbucket Server Integration Plugin implements this extension point to support OAuth 1.0 authentication. In Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusi...

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

io.jenkins.plugins:bitbucket-kubernetes-credentials (>=202.v15b_72a_698524, <=467.vdffa_a_9249dc5) potentially affected by CVE-2025-24398 via io.jenkins.plugins:atlassian-bitbucket-server-integration (>=3.4.2, <=4.1.1)

io.jenkins.plugins:atlassian-bitbucket-server-integration MAVEN version =3.4.2, =202.v15b72a698524, =467.vdffaa9249dc5 Source cves: CVE-2025-24398 Source advisory: MEND:CVE-2025-24398...

CVE-2025-24398

The Jenkins Bitbucket Server Integration Plugin versions 2.1.0 through 4.1.3 (both inclusive) is vulnerable to a Cross-Site Request Forgery (CSRF) bypass . The root cause is an overly permissive implementation of a Jenkins extension point used to support OAuth 1.0 authentication, which selectivel...

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

PT-2025-5356 · Jenkins · Jenkins Bitbucket Server Integration Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Bitbucket Server Integration Plugin versions 2.1.0 through 4.1.3 Description: The issue allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. This is due to an overly permissive...

CVE-2025-24398: Cross-Site Request Forgery (CSRF)

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

Jenkins Plugin: Bitbucket Server Integration – Cross-Site Request Forgery Vulnerability

Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A security vulnerability in...

Path Traversal org.springframework:spring-webmvc Dependency in Bitbucket Data Center and Server

This High severity org.springframework:spring-webmvc vulnerability exists in 8.9.0 - 8.9.23 and 8.19.0 to 8.19.12 of Bitbucket Data Center and Server. This org.springframework:spring-webmvc Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

DoS (Denial of Service) org.apache.cxf:cxf-rt-rs-security-jose Dependency in Bitbucket Data Center and Server

This High severity org.apache.cxf:cxf-rt-rs-security-jose Dependency vulnerability was introduced in versions 8.9.0, 8.18.0, and 8.19.0 of Bitbucket Data Center and Server. This org.apache.cxf:cxf-rt-rs-security-jose Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

DoS (Denial of Service) org.apache.tomcat.embed:tomcat-embed-core Dependency in Bitbucket Data Center and Server

This High severity org.apache.tomcat.embed:tomcat-embed-core Dependency vulnerability was introduced in versions 8.9.0 and 8.19.0 of Bitbucket Data Center and Server. This org.apache.tomcat.embed:tomcat-embed-core Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

PT-2024-5228 · Atlassian +1 · Bitbucket Data Center/Server +2

Name of the Vulnerable Software and Affected Versions: Apache CXF versions prior to 3.5.9 Apache CXF versions prior to 3.6.4 Apache CXF versions prior to 4.0.5 Bitbucket Data Center and Server versions 8.9.0 through 8.9.18 Bitbucket Data Center and Server versions 8.18.0 Bitbucket Data Center and...