PT-2025-45772 · Maven · Org.Jenkins-Ci.Plugins:Publish-To-Bitbucket

Publicado 2025-10-29 · Atualizado 2025-10-29

OSV

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Publish to Bitbucket Plugin 0.4 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

GHSA-V549-7PM5-F8QR

Produtos afetados

Org.Jenkins-Ci.Plugins:Publish-To-Bitbucket

Referências · 5

• https://github.com/jenkinsci/publish-to-bitbucket-plugin · Nota
• https://jenkins.io/security/advisory/2025-10-29/#SECURITY-3570 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-64148 · Nota de Segurança
• http://openwall.com/lists/oss-security/2025/10/29/2 · Nota
• https://osv.dev/vulnerability/GHSA-v549-7pm5-f8qr · Aviso do Fabricante