PT-2025-5356 · Jenkins · Jenkins Bitbucket Server Integration Plugin+1

Vincent Latombe · Published 2025-01-22 · Updated 2025-06-06 · CVE-2025-24398

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Server Integration Plugin versions 2.1.0 through 4.1.3

Description The issue allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. This is due to an overly permissive implementation in the Bitbucket Server Integration Plugin, which is intended to support OAuth 1.0 authentication. The plugin implements an extension point that selectively disables cross-site request forgery (CSRF) protection for specific URLs, but in versions 2.1.0 through 4.1.3, this implementation is too permissive.

Recommendations For Jenkins Bitbucket Server Integration Plugin versions 2.1.0 through 4.1.3, update to version 4.1.4, which restricts the URLs for which CSRF protection is disabled to only those that need it. As a temporary workaround, consider restricting access to the vulnerable plugin until a patch is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2025-02399

CVE-2025-24398

GHSA-QJW6-XVRM-5F2H

Affected Products

Jenkins

Jenkins Bitbucket Server Integration Plugin

References · 9

• https://jenkins.io/security/advisory/2025-01-22/#SECURITY-3434 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qjw6-xvrm-5f2h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24398 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24398 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02399 · Security Note
• https://github.com/jenkinsci/atlassian-bitbucket-server-integration-plugin · Note
• https://t.me/cvedetector/16129 · Telegram Post
• https://twitter.com/CVEnew/status/1882137391319892065 · Twitter Post
• https://t.me/cvenotify/124919 · Telegram Post