CVE-2022-20619: CSRF
First published: Wed Jan 12 2022(Updated: )
A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Bitbucket Branch Source | <=2.9.10 | |
| Jenkins Bitbucket Branch Source | =737.vdf9dc06105be | |
| maven/org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source | <2.9.7.2 | 2.9.7.2 |
| maven/org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source | >=2.9.8<2.9.11.2 | 2.9.11.2 |
| maven/org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source | >=720.vbe985dd73d66<725.vd9f8be0fa250 | 725.vd9f8be0fa250 |
| maven/org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source | >=726.v7e6f53de133c<746.v350d2781c184 | 746.v350d2781c184 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2022-20619
- https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2467
- http://www.openwall.com/lists/oss-security/2022/01/12/6
- https://github.com/CVEProject/cvelist/blob/2d78eb36f4d084db7fb35f1535d8d84fdcb7d859/2022/20xxx/CVE-2022-20619.json
- https://github.com/jenkinsci/bitbucket-branch-source-plugin/commit/a596f651a4b3bfe31a087c4d392e81c0167ab551
- https://github.com/advisories/GHSA-w4jv-6rg4-pr4m (Advisory)
Frequently Asked Questions
What is the severity of CVE-2022-20619?
The severity of CVE-2022-20619 is rated as high with a CVSS score of 7.1.
How can I mitigate the CSRF vulnerability in Jenkins Bitbucket Branch Source Plugin for CVE-2022-20619?
To mitigate the CSRF vulnerability in Jenkins Bitbucket Branch Source Plugin for CVE-2022-20619, update to version 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, or 2.9.7.2 or later that require POST requests for an HTTP endpoint.
- collector/nvd-index
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-w4jv-6rg4-pr4m
- alias/CVE-2022-20619
- collector/nvd-cve
- collector/github-advisory
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/author
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- agent/description
- agent/event
- agent/first-publish-date
- vendor/jenkins
- canonical/jenkins bitbucket branch source
- version/jenkins bitbucket branch source/2.9.10
- version/jenkins bitbucket branch source/737.vdf9dc06105be
- package-manager/maven