GHSA-vrpg-c7c4-8mpx

Source

https://github.com/advisories/GHSA-vrpg-c7c4-8mpx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-vrpg-c7c4-8mpx/GHSA-vrpg-c7c4-8mpx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vrpg-c7c4-8mpx

Aliases

CVE-2023-41937

Published

2023-09-06T15:30:26Z

Modified

2024-02-16T08:13:31.958028Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

SSRF vulnerability in Jenkins Bitbucket Push and Pull Request Plugin allows capturing credentials

Details

Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.

Database specific

{
    "nvd_published_at": "2023-09-06T13:15:10Z",
    "cwe_ids": [
        "CWE-918"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-30T23:07:57Z"
}

References

Affected packages

Maven / io.jenkins.plugins:bitbucket-push-and-pull-request

Package

Name: io.jenkins.plugins:bitbucket-push-and-pull-request; View open source insights on deps.dev
Purl: pkg:maven/io.jenkins.plugins/bitbucket-push-and-pull-request

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.4.0

Fixed

2.8.4

Affected versions

2.*

2.4.0

2.5

2.5.1

2.5.2

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.8.0

2.8.1

2.8.2-beta-1

2.8.2

2.8.3

Database specific

{
    "last_known_affected_version_range": "<= 2.8.3"
}