Skip to content
OpenAdvisories
Medium · 4.3 CVE-2022-20618 EUVD-2022-0711GHSA-w2mh-6xj5-f77f

Incorrect Permission Assignment for Critical Resource in Jenkins Bitbucket Branch Source Plugin

Published Jan 12, 2022 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Bitbucket Branch Source Plugin Package: org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source Category: Web / CMS Ecosystem: Maven

Description

A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Bitbucket Branch Source Plugin unspecified – ≤ 737.vdf9dc06105be 725.vd9f8be0fa250

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source >= 726.v7e6f53de133c, < 746.v350d2781c184 746.v350d2781c184 GHSA-w2mh-6xj5-f77f
Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source >= 720.vbe985dd73d66, < 725.vd9f8be0fa250 725.vd9f8be0fa250 GHSA-w2mh-6xj5-f77f
Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source >= 2.9.8, < 2.9.11.2 2.9.11.2 GHSA-w2mh-6xj5-f77f
Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source < 2.9.7.2 2.9.7.2 GHSA-w2mh-6xj5-f77f

References