GitHub Advisoryadvisory · Maven

GHSA-x8mf-jcmf-r79f Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin

MEDIUM Published 2024-06-26 Modified 2024-06-26 Official page ↗
Aliases
CVE-2024-39460
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-532
Reviewed
2024-06-26

Affected packages

• Maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source: < 887.va → fixed in 887.va

Description

Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases. Bitbucket Branch Source Plugin 887.va_d359b_3d2d8d does not include the Bitbucket OAuth access token as part of the Bitbucket URL in the build log.

Related

Alias · CVE (1)

  • CVE-2024-39460 Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References