Jenkins Bitbucket Branch Source Plugin prior to 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Bitbucket Branch Source Plugin 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 requires POST requests for the affected HTTP endpoint.

Affected Packages

Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source

Affected versions: 726.v7e6f53de133c (fixed in 746.v350d2781c184)

Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source

Affected versions: 720.vbe985dd73d66 (fixed in 725.vd9f8be0fa250)

Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source

Affected versions: 2.9.8 (fixed in 2.9.11.2)

Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source

Affected versions: 0 (fixed in 2.9.7.2)

Related CVEs

CVE-2022-20619

Key Information

GHSA ID

GHSA-w4jv-6rg4-pr4m

Published

January 13, 2022 12:01 AM

Last Modified

May 24, 2023 5:27 PM

CVSS Score

7.5 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 4, 2025 6:27 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.