PT-2023-28175 · Jenkins · Jenkins Bitbucket Push/Pull Request Plugin+1

Alvaro Muã±Oz + 3 · Published 2023-09-06 · Updated 2023-09-11 · CVE-2023-41937

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Push and Pull Request Plugin versions 2.4.0 through 2.8.3

Description The issue allows attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload. This is possible because the plugin trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs.

Recommendations For Jenkins Bitbucket Push and Pull Request Plugin versions 2.4.0 through 2.8.3, update to a version that fixes the issue, as the current versions trust values provided in the webhook payload, allowing potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-41937

GHSA-VRPG-C7C4-8MPX

Affected Products

Jenkins

Jenkins Bitbucket Push/Pull Request Plugin

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2023-41937 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41937 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vrpg-c7c4-8mpx · Vendor Advisory
• https://jenkins.io/security/advisory/2023-09-06/#SECURITY-3165 · Vendor Advisory
• https://twitter.com/CVEnew/status/1699416757050712536 · Twitter Post
• https://t.me/cvenotify/57982 · Telegram Post
• http://openwall.com/lists/oss-security/2023/09/06/9 · Note
• https://twitter.com/GHSecurityLab/status/1700193535805321315 · Twitter Post
• https://t.me/cibsecurity/69997 · Telegram Post
• https://t.me/cvenotify/57627 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1699435975686971776 · Twitter Post