The vulnerability of the Bitbucket Credentials Handler component of the Git-based software platform allows a hacker to gain control of a GitLab account associated with a Bitbucket account of another user, provided that Bitbucket is used as an OAuth 2.0 provider in GitLab.

The vulnerability of the Bitbucket Credentials Handler component of the Git-based software platform for collaborative code development on GitLab is related to inadequate access control mechanisms. Exploiting this vulnerability could allow a malicious actor to gain control over a GitLab account...

Bitbucket Datacenter REST API allows non-admin users to query all groups and members of the group

h3. Issue Summary Non-admin users any licensed user can query all the groups and members of the groups using the below API Groups API|https://developer.atlassian.com/server/bitbucket/rest/v819/api-group-permission-management/api-api-latest-admin-groups-get Group memberships...

PT-2024-5228 · Atlassian +1 · Bitbucket Data Center/Server +2

Name of the Vulnerable Software and Affected Versions: Apache CXF versions prior to 3.5.9 Apache CXF versions prior to 3.6.4 Apache CXF versions prior to 4.0.5 Bitbucket Data Center and Server versions 8.9.0 through 8.9.18 Bitbucket Data Center and Server versions 8.18.0 Bitbucket Data Center and...

PT-2024-5837

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1 Oracle GraalVM for JDK versions 17.0.11, 21.0.3, 22.0.1 Oracle GraalVM Enterprise Edition versions 20.3.14, 21.3.10 Bitbucket Data Center and Server versions 8.9.0...

The vulnerability of the Jenkins Bitbucket Branch Source Plugin, related to the disclosure of information through registration files, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Jenkins Bitbucket Branch Source Plugin is related to the disclosure of information through registration files. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Insertion Of Sensitive Information Into Log File

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source is vulnerable to Insertion Of Sensitive Information Into Log File. The vulnerability is due to the token being printed in the build log as part of the Bitbucket URL. An attacker can view the token and gain unauthorized access...

CVE-2024-39460

A vulnerability was found in Jenkins Bitbucket. In some cases, it prints the Bitbucket OAuth access token as part of the Bitbucket URL...

Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin

Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases. Bitbucket Branch Source Plugin 887.vad359b3d2d8d does not include the Bitbucket OAuth access token as part of the Bitbucket URL in the...

org.jenkins-ci.plugins:bitbucket-filter-project-trait (1.0) potentially affected by CVE-2024-39460 via org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.2.13)

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source MAVEN version 2.2.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source and may be impacted: -...

org.jenkins-ci.plugins:skip-notifications-trait (>=1.0.0, <=1.0.2) potentially affected by CVE-2024-39460 via org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.2.0)

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source and may be impacted: - org.jenkins-ci.plugins:skip-notifications-trait...

org.jenkins-ci.plugins:bitbucket-approval-filter (1.0.0) potentially affected by CVE-2024-39460 via org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.4.1)

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source and may be impacted: - org.jenkins-ci.plugins:bitbucket-approval-filte...

GHSA-X8MF-JCMF-R79F Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin

Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases. Bitbucket Branch Source Plugin 887.vad359b3d2d8d does not include the Bitbucket OAuth access token as part of the Bitbucket URL in the...

CVE-2024-39460

Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases...

CVE-2024-39460

Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases...

CVE-2024-39460

The Jenkins Bitbucket Branch Source Plugin (versions 886.v44cf5e4ecec5 and earlier) is vulnerable to the insertion of sensitive information into log files. In certain cases, the plugin prints the Bitbucket OAuth access token as part of the Bitbucket URL within the build log. An attacker who can v...

CVE-2024-39460

Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases...

CVE-2024-39460

Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases...

CVE-2024-39460

Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases...

CVE-2024-39460

Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases...

Jenkins plugins Multiple Vulnerabilities (2024-06-26)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Low Structs Plugin provides utility functionality used, e.g., in Pipeline to instantiate and configure build steps, typically before their...