Publish to Bitbucket CVE-2025-64150

Requires an authenticated Jenkins account with at least Overall/Read permission (the lowest authenticated tier), so it is not exploitable by anonymous users unless anonymous read is enabled. The attacker must also already know a valid credentials ID stored in Jenkins, which the description states is 'obtained through another method' - a meaningful limiting prerequisite. The attacker must be able to direct the plugin to an attacker-controlled URL to receive the exfiltrated secret. Affected deployments are those running Publish to Bitbucket Plugin version 0.4 or earlier; later/patched versions are not affected.

This is a moderate, authenticated-access credential-disclosure issue, not an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable flaw requiring low privileges (Jenkins Overall/Read) and no user interaction. Exploitation status is 'no public exploit identified at time of analysis' - there is no KEV listing and no POC referenced. The EPSS score of 0.24% (14th percentile) reinforces low near-term exploitation likelihood. No SSVC decision record was provided. The signals are internally consistent: network vector matches a web-based Jenkins plugin action, and PR:L correctly reflects that Overall/Read is the minimum authenticated level - this is an authorization gap (CWE-862 Missing Authorization), so an attacker must already hold a valid Jenkins account. One nuance to verify: the description notes credential IDs must be 'obtained through another method,' an additional prerequisite the base CVSS AC:L does not fully capture, and the real impact (theft of stored secrets) is arguably higher than the official C:L rating suggests. Overall this is a credible insider/low-privilege-account risk in environments where many users hold Overall/Read, but it is not a widespread remote-unauthenticated threat.

An attacker who holds only a low-privilege Jenkins account (Overall/Read) and has separately learned the ID of a stored credential invokes the plugin's connection-test function, pointing it at a server they control and selecting that credential ID. The plugin, lacking a permission check, sends the stored credential to the attacker's URL, disclosing secrets the user should not have access to. No public exploit code is identified at time of analysis.