Publish To Bitbucket
Monthly
Credential disclosure in the Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows authenticated users holding only Overall/Read permission to point the plugin at an attacker-controlled URL and capture Jenkins-stored credentials. Exploitation is not trivial: the attacker must already possess a valid credentials ID (obtained through another method per the description) and must control the endpoint the plugin contacts, which is why this is assessed as a moderate, authenticated-access issue rather than an urgent priority; this maps to an assessed vector of AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.24% (14th percentile).
Cross-site request forgery in the Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows an attacker to ride a victim's active, authenticated Jenkins session and make the plugin connect to an attacker-specified URL using attacker-specified Jenkins credentials IDs, with the result that credentials stored in Jenkins are captured by the attacker. Two preconditions materially constrain real-world exploitation: the attacker must already possess valid credential IDs 'obtained through another method' (the flaw abuses credentials, it does not disclose their identifiers), and a logged-in Jenkins user must be induced to trigger the forged request. No public exploit code has been identified at time of analysis, EPSS is 0.21% (10th percentile), and the issue is not confirmed actively exploited (no CISA KEV listing), making this a moderate-severity, low-priority item in practice.
Credential ID enumeration in Jenkins Publish to Bitbucket Plugin 0.4 and earlier lets any authenticated user holding Overall/Read permission list the IDs of credentials stored in Jenkins, because the plugin omits a permission check (CWE-862) on the endpoint that exposes that information. Only credential identifiers are disclosed - the underlying secret values are never exposed - so the practical impact is reconnaissance that can aid follow-on attacks, widening only where Overall/Read is granted to anonymous users or a large untrusted user base. No public exploit code or confirmed active exploitation has been identified (EPSS 0.27%, roughly the 17th percentile), making this a low-to-moderate risk information-disclosure issue rather than a priority emergency.
Credential disclosure in the Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows authenticated users holding only Overall/Read permission to point the plugin at an attacker-controlled URL and capture Jenkins-stored credentials. Exploitation is not trivial: the attacker must already possess a valid credentials ID (obtained through another method per the description) and must control the endpoint the plugin contacts, which is why this is assessed as a moderate, authenticated-access issue rather than an urgent priority; this maps to an assessed vector of AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.24% (14th percentile).
Cross-site request forgery in the Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows an attacker to ride a victim's active, authenticated Jenkins session and make the plugin connect to an attacker-specified URL using attacker-specified Jenkins credentials IDs, with the result that credentials stored in Jenkins are captured by the attacker. Two preconditions materially constrain real-world exploitation: the attacker must already possess valid credential IDs 'obtained through another method' (the flaw abuses credentials, it does not disclose their identifiers), and a logged-in Jenkins user must be induced to trigger the forged request. No public exploit code has been identified at time of analysis, EPSS is 0.21% (10th percentile), and the issue is not confirmed actively exploited (no CISA KEV listing), making this a moderate-severity, low-priority item in practice.
Credential ID enumeration in Jenkins Publish to Bitbucket Plugin 0.4 and earlier lets any authenticated user holding Overall/Read permission list the IDs of credentials stored in Jenkins, because the plugin omits a permission check (CWE-862) on the endpoint that exposes that information. Only credential identifiers are disclosed - the underlying secret values are never exposed - so the practical impact is reconnaissance that can aid follow-on attacks, widening only where Overall/Read is granted to anonymous users or a large untrusted user base. No public exploit code or confirmed active exploitation has been identified (EPSS 0.27%, roughly the 17th percentile), making this a low-to-moderate risk information-disclosure issue rather than a priority emergency.