PT-2023-19588 · Jenkins · Jenkins Bitbucket Oauth Plugin+1

Wadeck Follonier · Published 2023-01-24 · Updated 2023-02-04 · CVE-2023-24428

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket OAuth Plugin versions 0.12 and earlier

Description A cross-site request forgery (CSRF) issue allows attackers to trick users into logging in to the attacker's account. This can be achieved by exploiting the vulnerability in the Jenkins Bitbucket OAuth Plugin, which enables attackers to perform unauthorized actions on behalf of the user.

Recommendations For Jenkins Bitbucket OAuth Plugin versions 0.12 and earlier, consider disabling the OAuth functionality until a patch is available to prevent exploitation of the CSRF vulnerability. Restrict access to sensitive operations that rely on the OAuth plugin to minimize the risk of unauthorized access.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-24428

GHSA-685J-36QX-3VP2

Affected Products

Jenkins

Jenkins Bitbucket Oauth Plugin

References · 7

• https://jenkins.io/security/advisory/2023-01-24/#SECURITY-2981 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24428 · Security Note
• https://osv.dev/vulnerability/CVE-2023-24428 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-685j-36qx-3vp2 · Vendor Advisory
• https://github.com/jenkinsci/bitbucket-oauth-plugin · Note
• https://github.com/jenkinsci/bitbucket-oauth-plugin/commit/a927a8ff2e069afebb97f33f6798033ef4451e4f · Note
• https://t.me/cvenotify/43642 · Telegram Post