CVE-2023-41937

High

Description

Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.

SeverityHigh

CVSS7.5

Exploit probability—

Product

Jenkins Bitbucket Push And Pull Request

PublishedSep 6, 2023

First seenSep 6, 2023

How to fix

Update

io.jenkins.plugins:bitbucket-push-and-pull-request2.8.4 or later

Vendor advisories

jenkins.io/security/advisory/2023-09-06/#SECURITY-3165

Affected products

Product	Affected versions	Fixed in
jenkins bitbucket_push_and_pull_request	2.4.0 ≤ v ≤ 2.8.3	—
io.jenkins.plugins:bitbucket-push-and-pull-requestMaven	2.4.0 ≤ v < 2.8.4	2.8.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.