PT-2022-18831 · Jenkins · Jenkins Bitbucket Server Integration Plugin+1

Kevin Guerroudj · Published 2022-03-29 · Updated 2024-01-09 · CVE-2022-28133

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Server Integration Plugin versions 3.1.0 and earlier

Description The issue results from the plugin not limiting URL schemes for callback URLs on OAuth consumers, leading to a stored cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by attackers who can create BitBucket Server consumers.

Recommendations For Jenkins Bitbucket Server Integration Plugin versions 3.1.0 and earlier, update to a version that limits URL schemes for callback URLs on OAuth consumers to prevent stored cross-site scripting (XSS) attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-28133

GHSA-45V7-65Q8-X294

Affected Products

Jenkins

Jenkins Bitbucket Server Integration Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-28133 · Security Note
• https://jenkins.io/security/advisory/2022-03-29/#SECURITY-2639 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28133 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-45v7-65q8-x294 · Vendor Advisory
• https://github.com/jenkinsci/atlassian-bitbucket-server-integration-plugin · Note
• https://t.me/cvenotify/66715 · Telegram Post
• https://t.me/cibsecurity/39736 · Telegram Post
• http://openwall.com/lists/oss-security/2022/03/29/1 · Note