PT-2022-14827 · Jenkins · Jenkins Bitbucket Branch Source Plugin+1

Devin Nusbaum · Published 2022-01-12 · Updated 2023-11-30 · CVE-2022-20619

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Branch Source Plugin versions prior to 746.v350d2781c184 Jenkins Bitbucket Branch Source Plugin versions prior to 725.vd9f8be0fa250 Jenkins Bitbucket Branch Source Plugin versions prior to 2.9.11.2 Jenkins Bitbucket Branch Source Plugin versions prior to 2.9.7.2 Jenkins Bitbucket Branch Source Plugin version 737.vdf9dc06105be and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. This issue arises because the plugin does not require POST requests for a specific HTTP endpoint, which can be exploited by attackers with Overall/Read access.

Recommendations For Jenkins Bitbucket Branch Source Plugin versions prior to 746.v350d2781c184, update to version 746.v350d2781c184 or later. For Jenkins Bitbucket Branch Source Plugin versions prior to 725.vd9f8be0fa250, update to version 725.vd9f8be0fa250 or later. For Jenkins Bitbucket Branch Source Plugin versions prior to 2.9.11.2, update to version 2.9.11.2 or later. For Jenkins Bitbucket Branch Source Plugin versions prior to 2.9.7.2, update to version 2.9.7.2 or later. For Jenkins Bitbucket Branch Source Plugin version 737.vdf9dc06105be and earlier, update to a version later than 737.vdf9dc06105be.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-20619

GHSA-W4JV-6RG4-PR4M

Affected Products

Jenkins

Jenkins Bitbucket Branch Source Plugin

References · 10

• 🔥 https://github.com/CVEProject/cvelist/blob/2d78eb36f4d084db7fb35f1535d8d84fdcb7d859/2022/20xxx/CVE-2022-20619.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-20619 · Security Note
• https://jenkins.io/security/advisory/2022-01-12/#SECURITY-2467 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w4jv-6rg4-pr4m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20619 · Vendor Advisory
• https://github.com/jenkinsci/bitbucket-branch-source-plugin/commit/a596f651a4b3bfe31a087c4d392e81c0167ab551 · Note
• https://github.com/jenkinsci/bitbucket-branch-source-plugin · Note
• https://t.me/cvenotify/25339 · Telegram Post
• https://t.me/cvenotify/61750 · Telegram Post
• http://openwall.com/lists/oss-security/2022/01/12/6 · Note