In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.

Affected Packages

Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source

Affected versions: 0 (fixed in 871.v28d74e8b_4226)

Related CVEs

CVE-2024-28152

Key Information

GHSA ID

GHSA-m4rm-x2rr-357w

Published

March 6, 2024 6:30 PM

Last Modified

November 7, 2024 7:18 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.