PT-2025-44298 · Jenkins · Jenkins Publish To Bitbucket Plugin+1

Published 2025-10-29 · Updated 2025-10-30 · CVE-2025-64149

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Publish to Bitbucket Plugin versions 0.4 and earlier

Description A cross-site request forgery (CSRF) flaw exists in the Jenkins Publish to Bitbucket Plugin. This issue allows attackers to connect to a URL specified by the attacker, utilizing credentials obtained through separate means. The flaw can lead to the capture of credentials stored within Jenkins.

Recommendations Update Jenkins Publish to Bitbucket Plugin to a version later than 0.4.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-64149

GHSA-M244-6MFF-P355

Affected Products

Jenkins

Jenkins Publish To Bitbucket Plugin

References · 9

• https://osv.dev/vulnerability/GHSA-m244-6mff-p355 · Vendor Advisory
• https://jenkins.io/security/advisory/2025-10-29/#SECURITY-3576 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64149 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64149 · Security Note
• https://github.com/jenkinsci/publish-to-bitbucket-plugin · Note
• https://t.me/CVEtracker/36071 · Telegram Post
• https://twitter.com/CVEnew/status/1983530912999707071 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ok2mxi/resumen_diario_de_vulnerabilidades_30102025 · Reddit Post
• http://openwall.com/lists/oss-security/2025/10/29/2 · Note