PT-2024-22298 · Jenkins · Jenkins Bitbucket Branch Source Plugin+1

Anders Hammar · Published 2024-03-06 · Updated 2025-09-18 · CVE-2024-28152

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Branch Source Plugin versions 866.vdea 7dcd3008e and earlier, except version 848.850.v6a a 2a 234a c81

Description The issue allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server and the trust policy "Forks in the same account" is in place. This occurs when discovering pull requests from forks.

Recommendations For versions 866.vdea 7dcd3008e and earlier, except version 848.850.v6a a 2a 234a c81, consider restricting the use of the "Forks in the same account" trust policy until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2024-28152

GHSA-M4RM-X2RR-357W

Affected Products

Jenkins

Jenkins Bitbucket Branch Source Plugin

References · 11

• https://osv.dev/vulnerability/CVE-2024-28152 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m4rm-x2rr-357w · Vendor Advisory
• https://jenkins.io/security/advisory/2024-03-06/#SECURITY-3300 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28152 · Security Note
• https://github.com/jenkinsci/bitbucket-branch-source-plugin/commit/28d74e8b4226bfc7524b412e34f7090784cc1a08 · Note
• https://github.com/jenkinsci/bitbucket-branch-source-plugin · Note
• https://t.me/cvenotify/73183 · Telegram Post
• https://t.me/cveNotify/135823 · Telegram Post
• https://t.me/cvenotify/100937 · Telegram Post
• https://t.me/cvenotify/73149 · Telegram Post
• http://openwall.com/lists/oss-security/2024/03/06/3 · Note