Publish to Bitbucket
CVE-2025-64148
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with Overall/Read permission
-
ExploitRequest plugin endpoint lacking permission check
-
ExecutionEnumerate stored credential IDs
-
ImpactUse IDs to plan credential-targeting attacks
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Jenkins account holding Overall/Read permission and the Publish to Bitbucket Plugin version 0.4 or earlier installed on the Jenkins controller. Exploitation is limited to enumerating credential IDs only - the actual credential secret values are not exposed - and the impact widens only where Overall/Read is granted to anonymous or a large, untrusted user base. It does not grant unauthenticated access and requires no user interaction beyond the attacker's own authenticated request. |
| Impact | This is a low-to-moderate risk information-disclosure issue, not a priority emergency. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/C:L/I:N/A:N) correctly reflects a network-reachable but authenticated flaw with only limited confidentiality impact and no integrity or availability effect. EPSS is low at 0.27% (17th percentile), consistent with a plugin-specific authorization gap that is unlikely to be mass-exploited. It is NOT in CISA KEV and no public exploit code was identified, so this is neither actively exploited nor weaponized. The signals are internally consistent: a CWE-862 missing-authorization bug exposing only credential IDs (not secret values) to any user holding Overall/Read, with no SSVC 'automatable' or high-technical-impact indicators present in the data. The main caveat: PR:L here means a legitimate low-privilege Jenkins user, so real risk is scoped to environments that grant Overall/Read broadly (e.g., to anonymous or large user populations). |
| Exploit ScenarioDerived | A low-privileged Jenkins user (or anonymous user if Overall/Read is granted to anonymous) who holds only Overall/Read sends a request to a Publish to Bitbucket Plugin endpoint that fails to check for the required permission, causing it to return the IDs of credentials stored in Jenkins. The attacker harvests these credential IDs to map which secrets exist and target follow-on attacks, though the credential secret values themselves are not disclosed. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Credential ID enumeration in Jenkins Publish to Bitbucket Plugin 0.4 and earlier lets any authenticated user holding Overall/Read permission list the IDs of credentials stored in Jenkins, because the plugin omits a permission check (CWE-862) on the endpoint that exposes that information. Only credential identifiers are disclosed - the underlying secret values are never exposed - so the practical impact is reconnaissance that can aid follow-on attacks, widening only where Overall/Read is granted to anonymous users or a large untrusted user base. No public exploit code or confirmed active exploitation has been identified (EPSS 0.27%, roughly the 17th percentile), making this a low-to-moderate risk information-disclosure issue rather than a priority emergency.
RemediationAI
Update the Publish to Bitbucket Plugin to the fixed release identified in the Jenkins security advisory of 2025-10-29 (SECURITY-3570, https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3570); the provided data confirms an advisory-level fix but does not state the exact fixed version, so verify the version number in the advisory before upgrading, then restart the Jenkins controller to apply it. Where immediate upgrading is not possible, compensating controls are to restrict Overall/Read so that it is never granted to anonymous users and is limited to a small, trusted set of accounts (trade-off: users who legitimately need read access to builds must be individually granted the permission, and any anonymous read access currently relied upon will stop working); if the plugin is not in active use, disable or uninstall it from Manage Plugins (trade-off: any pipeline or freestyle job using the Publish to Bitbucket build step will fail until the plugin is restored); and monitor Jenkins authentication and access logs for unusual enumeration of credential IDs or repeated calls to plugin endpoints by low-privilege accounts, noting that logging is detective only and does not close the exposure. Credential secrets themselves are not exposed by this flaw, so a wholesale credential rotation is not strictly required unless the leaked IDs expose a separate weakness in how credentials are referenced.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Jenkins Publish to Bitbucket Plugin adds a build/publish step that pushes artifacts and build information to Bitbucket from a Jenkins controller, and it interacts with the Jenkins credentials subsystem, where every stored credential is addressable by a unique ID string. The vulnerability is a missing authorization check (CWE-862) on a plugin endpoint: the code fails to verify that the requesting user has a permission sufficient for reading credential metadata, so it falls back to the weaker Overall/Read permission instead of the credential-related permissions Jenkins normally enforces. Because the CPE entry cpe:2.3:a:jenkins:publish_to_bitbucket:*:*:*:*:*:jenkins:*:* covers all versions, every release up to and including 0.4 is in scope. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms the exposure is remote (network), requires low privileges (PR:L, i.e., an authenticated Jenkins account), needs no user interaction, is scoped to the vulnerable component, and yields only a low confidentiality impact with no integrity or availability effect - consistent with an ID/enumeration leak rather than credential theft.
Know when Publish To Bitbucket gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable endpoint (AV:N), no special conditions (AC:L), requires a low-privilege Overall/Read account (PR:L), no user interaction; only credential IDs leak, so C:L and I/A:N.
Primary rating from Vendor (googlegroups).
CVSS VectorVendor: googlegroups
DescriptionCVE.org
A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
More in Publish To Bitbucket
View allCredential disclosure in the Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows authenticated users holding only
Cross-site request forgery in the Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows an attacker to ride a victi
GitHub PoC
Exploit-DB