GHSA-45v7-65q8-x294
Stored XSS vulnerability in Jenkins Bitbucket Server Integration Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.jenkins.plugins:atlassian-bitbucket-server-integration | >= 2.0.0, < 3.2.0 | 3.2.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create BitBucket Server consumers.
References
External links from the advisory. They lead to third-party sites.