PT-2025-44299 · Jenkins · Jenkins Publish To Bitbucket Plugin+1

Published 2025-10-29 · Updated 2025-10-30 · CVE-2025-64150

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Publish to Bitbucket Plugin versions 0.4 and earlier

Description A flaw exists where a missing permission check allows attackers possessing Overall/Read permission to establish a connection to a URL specified by the attacker, utilizing credentials IDs obtained through separate means. This can lead to the capture of credentials stored within Jenkins.

Recommendations Update Jenkins Publish to Bitbucket Plugin to a version later than 0.4.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-64150

GHSA-WPR5-RC2J-99P2

Affected Products

Jenkins

Jenkins Publish To Bitbucket Plugin

References · 10

• https://jenkins.io/security/advisory/2025-10-29/#SECURITY-3576 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64150 · Security Note
• https://osv.dev/vulnerability/GHSA-wpr5-rc2j-99p2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64150 · Vendor Advisory
• https://github.com/jenkinsci/publish-to-bitbucket-plugin · Note
• https://twitter.com/VulmonFeeds/status/1983558628826103926 · Twitter Post
• https://twitter.com/CVEnew/status/1983530912030875735 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ok2mxi/resumen_diario_de_vulnerabilidades_30102025 · Reddit Post
• http://openwall.com/lists/oss-security/2025/10/29/2 · Note
• https://t.me/CVEtracker/36072 · Telegram Post