PT-2025-45772 · Maven · Org.Jenkins-Ci.Plugins:Publish-To-Bitbucket

Published 2025-10-29 · Updated 2025-10-29

OSV

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Publish to Bitbucket Plugin 0.4 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

GHSA-V549-7PM5-F8QR

Affected Products

Org.Jenkins-Ci.Plugins:Publish-To-Bitbucket

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-64148 · Security Note
• https://osv.dev/vulnerability/GHSA-v549-7pm5-f8qr · Vendor Advisory
• https://github.com/jenkinsci/publish-to-bitbucket-plugin · Note
• https://jenkins.io/security/advisory/2025-10-29/#SECURITY-3570 · Note
• http://openwall.com/lists/oss-security/2025/10/29/2 · Note