GHSA-m4rm-x2rr-357w

Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-28152

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source	< 871.v28d74e8b_4226	871.v28d74e8b_4226

Details

As written in the advisory (Markdown source, shown as plain text).

In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-28152 advisory
https://github.com/jenkinsci/bitbucket-branch-source-plugin/commit/28d74e8b4226bfc7524b412e34f7090784cc1a08 web
https://github.com/jenkinsci/bitbucket-branch-source-plugin package
https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300 web
http://www.openwall.com/lists/oss-security/2024/03/06/3 web