~ / search / GHSA-w4jv-6rg4-pr4m

GHSA-w4jv-6rg4-pr4m

Cross-Site Request Forgery in Jenkins Bitbucket Branch Source Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2022-20619

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source >= 726.v7e6f53de133c, < 746.v350d2781c184 746.v350d2781c184
Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source >= 720.vbe985dd73d66, < 725.vd9f8be0fa250 725.vd9f8be0fa250
Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source >= 2.9.8, < 2.9.11.2 2.9.11.2
Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source < 2.9.7.2 2.9.7.2

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Bitbucket Branch Source Plugin prior to 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Bitbucket Branch Source Plugin 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 requires POST requests for the affected HTTP endpoint.

References

External links from the advisory. They lead to third-party sites.