GitHub Advisoryadvisory · Maven

GHSA-m4rm-x2rr-357w Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests

MEDIUM Published 2024-03-06 Modified 2024-11-07 Official page ↗
Aliases
CVE-2024-28152
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-281
Reviewed
2024-03-06

Affected packages

• Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source: < 871.v28d74e8b_4226 → fixed in 871.v28d74e8b_4226

Description

In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.

Related

Alias · CVE (1)

  • CVE-2024-28152 In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests… vulnerability

Weakness · CWE (1)

  • CWE-281 Improper Preservation of Permissions weakness

References