Publish to Bitbucket
CVE-2025-64149
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid credentials ID out-of-band
-
DeliveryLure authenticated Jenkins user to malicious page
-
ExploitForged request hits plugin connection endpoint
-
ExecutionPlugin connects to attacker URL with stored credential
-
ImpactCapture exfiltrated credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires three concrete conditions drawn from the description: (1) the attacker must already possess valid Jenkins credentials IDs 'obtained through another method' - the flaw does not grant the IDs, it only abuses them; (2) a victim with an active, authenticated Jenkins session must be induced to trigger the forged request (the hallmark of CSRF, CWE-352); and (3) the Publish to Bitbucket Plugin version 0.4 or earlier must be installed. Limiting factors: dependence on a pre-obtained credential ID and on victim interaction materially reduce real-world exploitability despite the AV:N/AC:L rating, and impact is confined to disclosure/misuse of stored credentials (no availability impact). |
| Impact | This is a moderate-severity, low-priority issue in practice. The published CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 5.4) indicates network reach, low complexity, low-privilege prerequisites and partial confidentiality/integrity impact, but NO availability impact and an unchanged scope. The EPSS score is very low (0.21%, 10th percentile), the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced - so exploitation status is 'no public exploit identified at time of analysis.' A notable internal inconsistency must be flagged: this is CWE-352 (CSRF), which by definition abuses an authenticated victim's session via tricking them, yet the vector lists UI:N (no user interaction) and PR:L (attacker holds low privileges) - for a classic CSRF one would expect UI:R and PR:N; verify the intended exploitation model with the Jenkins advisory. Additionally, the description states the attacker must already possess valid credential IDs 'obtained through another method,' which is a real precondition the CVSS AC:L rating arguably understates. Net: low-complexity in theory, but the dependency on pre-obtained credential IDs plus a niche plugin footprint makes this a patch-in-normal-cycle item, not an emergency. |
| Exploit ScenarioDerived | An attacker who has already learned a valid Jenkins credentials ID crafts a malicious web page that, when visited by a logged-in Jenkins user, submits a forged request causing the Publish to Bitbucket plugin to connect to an attacker-controlled URL using those stored credentials - leaking the secret to the attacker's server. No public exploit code is referenced, and success depends on the attacker first obtaining a usable credentials ID and the victim having an active Jenkins session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Cross-site request forgery in the Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows an attacker to ride a victim's active, authenticated Jenkins session and make the plugin connect to an attacker-specified URL using attacker-specified Jenkins credentials IDs, with the result that credentials stored in Jenkins are captured by the attacker. Two preconditions materially constrain real-world exploitation: the attacker must already possess valid credential IDs 'obtained through another method' (the flaw abuses credentials, it does not disclose their identifiers), and a logged-in Jenkins user must be induced to trigger the forged request. No public exploit code has been identified at time of analysis, EPSS is 0.21% (10th percentile), and the issue is not confirmed actively exploited (no CISA KEV listing), making this a moderate-severity, low-priority item in practice.
RemediationAI
No fixed release version is identifiable from the data provided, so administrators should check the Jenkins Security Advisory SECURITY-3576 (https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3576, mirrored at http://www.openwall.com/lists/oss-security/2025/10/29/2) for the current patched version of Publish to Bitbucket and upgrade as soon as it is published; the determination 'no vendor-released patch identified at time of analysis' reflects the absence of fix-version data in this input, not confirmation that no fix exists, and Jenkins typically ships remediated plugin releases alongside such advisories. If the plugin is not actively used for Bitbucket publishing, uninstalling it is the cleanest mitigation and eliminates the attack surface entirely; the trade-off is the loss of that build-pipeline functionality until a patched release is installed. Regardless of upgrade timing, rotate or revoke every Jenkins-stored credential that the plugin could reference (particularly Bitbucket/SCM credentials), since theft cannot be ruled out for any credential whose ID was known - expect job reconfiguration wherever those credential IDs are bound. Keep Jenkins' default CSRF crumb protection enabled and avoid weakening it, and restrict Jenkins controller access to trusted networks or place it behind a VPN/reverse proxy with authentication, since the attack still requires a logged-in victim to be lured into issuing the forged request - the trade-off is reduced accessibility for legitimate users and integrations. Finally, treat the pre-existing credential-ID disclosure as a separate incident: audit where credential IDs may have leaked (build logs, job configurations, API responses), as remediating this CVE does not undo that prerequisite.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-352 (Cross-Site Request Forgery): affected endpoints in the Jenkins Publish to Bitbucket Plugin 0.4 and earlier do not adequately tie a state-changing request to an authenticated user's intent, so a browser holding a valid Jenkins session cookie will silently submit the attacker's forged request. Jenkins normally defends plugin endpoints with its crumb (CSRF token) mechanism and by requiring POST for state-changing operations; endpoints that omit these protections - or that fail to enforce the appropriate permission check - become CSRF-reachable. Here the abused functionality is the plugin's ability to initiate an outbound connection to a Bitbucket-style URL while selecting a stored credential by ID; because the plugin resolves the supplied credential ID server-side and attaches the real secret to the outbound request, the attacker does not need to read the secret from Jenkins - it is effectively delivered to the attacker's endpoint. The affected component is captured by the CPE cpe:2.3:a:jenkins:publish_to_bitbucket:*:*:*:*:*:jenkins:*:* (Jenkins plugin distribution channel), i.e. the plugin bundle rather than the Jenkins core. Note that NVD's CVSS v3.1 vector scores this as PR:L (5.4), whereas our independent assessment scores it PR:N/UI:R; both models agree that impact is limited to confidentiality and integrity of stored credentials (C:L/I:L) with no availability impact, and neither describes a privilege-escalation or code-execution primitive. Coupled with the requirement that credential IDs already be known to the attacker, the realistic exposure is credential theft or reuse against whatever systems those Jenkins credentials authenticate to.
Know when Publish To Bitbucket gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
As a CSRF, the attacker is unauthenticated (PR:N) but needs the victim to trigger the request (UI:R); credential capture yields limited C/I impact and no availability loss.
Primary rating from Vendor (googlegroups).
CVSS VectorVendor: googlegroups
DescriptionCVE.org
A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Affected Products (CPE)CVE.org
More in Publish To Bitbucket
View allCredential disclosure in the Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows authenticated users holding only
Credential ID enumeration in Jenkins Publish to Bitbucket Plugin 0.4 and earlier lets any authenticated user holding Ove
GitHub PoC
Exploit-DB