CVE-2023-41937

Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and…

published September 6, 2023

CVSS
—
EPSS
1%
Percentile
51.7
In the wild
Unconfirmed
What it is

Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00676 · 51.7th percentile
Published
2023-09-06T12:08Z
EPSS history
Timeline
  • 06 SEP 12:08Z
    Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and…
    cvelistv5