GHSA-w4jv-6rg4-pr4m Cross-Site Request Forgery in Jenkins Bitbucket Branch Source Plugin

• Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source: >= 726.v7e6f53de133c, < 746.v350d2781c184 → fixed in 746.v350d2781c184 • Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source: >= 720.vbe985dd73d66, < 725.vd9f8be0fa250 → fixed in 725.vd9f8be0fa250 • Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source: >= 2.9.8, < 2.9.11.2 → fixed in 2.9.11.2 • Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source: < 2.9.7.2 → fixed in 2.9.7.2

Jenkins Bitbucket Branch Source Plugin prior to 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Bitbucket Branch Source Plugin 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 requires POST requests for the affected HTTP endpoint.