Description
A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Bitbucket Branch Source Plugin | unspecified – ≤ 737.vdf9dc06105be | 725.vd9f8be0fa250 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source | >= 726.v7e6f53de133c, < 746.v350d2781c184 | 746.v350d2781c184 | GHSA-w4jv-6rg4-pr4m |
| Maven | org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source | >= 720.vbe985dd73d66, < 725.vd9f8be0fa250 | 725.vd9f8be0fa250 | GHSA-w4jv-6rg4-pr4m |
| Maven | org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source | >= 2.9.8, < 2.9.11.2 | 2.9.11.2 | GHSA-w4jv-6rg4-pr4m |
| Maven | org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source | < 2.9.7.2 | 2.9.7.2 | GHSA-w4jv-6rg4-pr4m |