PT-2023-28175 · Jenkins · Jenkins Bitbucket Push/Pull Request Plugin+1

Alvaro Muã±Oz + 3 · Publicado 2023-09-06 · Atualizado 2023-09-11 · CVE-2023-41937

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Push and Pull Request Plugin versions 2.4.0 through 2.8.3

Description The issue allows attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload. This is possible because the plugin trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs.

Recommendations For Jenkins Bitbucket Push and Pull Request Plugin versions 2.4.0 through 2.8.3, update to a version that fixes the issue, as the current versions trust values provided in the webhook payload, allowing potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2023-41937

GHSA-VRPG-C7C4-8MPX

Produtos afetados

Jenkins

Jenkins Bitbucket Push/Pull Request Plugin

Referências · 11

• https://nvd.nist.gov/vuln/detail/CVE-2023-41937 · Nota de Segurança
• https://twitter.com/CVEnew/status/1699416757050712536 · Publicação no Twitter
• https://t.me/cvenotify/57982 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-41937 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vrpg-c7c4-8mpx · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/09/06/9 · Nota
• https://twitter.com/GHSecurityLab/status/1700193535805321315 · Publicação no Twitter
• https://t.me/cibsecurity/69997 · Publicação no Telegram
• https://t.me/cvenotify/57627 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1699435975686971776 · Publicação no Twitter
• https://jenkins.io/security/advisory/2023-09-06/#SECURITY-3165 · Aviso do Fabricante