Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.

VectorNETWORK

PublishedJan 22, 2025, 17:15

Published Byjenkinsci-cert@googlegroups.com

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

io.jenkins.plugins:atlassian-bitbucket-server-integration(Maven)2.1.04.1.4N/A

References

https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3434

Weakness Type

CWE-352

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK