CVE-2025-64148: Medium severity Jenkins Publish to Bitbucket Plugin vulnerability
A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Other sources
Jenkins Publish to Bitbucket Plugin 0.4 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
As of publication of this advisory, there is no fix.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict Overall/Read permission in Jenkins to trusted users to prevent attackers from enumerating credential IDs in the Publish to Bitbucket Plugin.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64148?
CVE-2025-64148 is a medium severity vulnerability that allows unauthorized enumeration of credentials IDs in Jenkins.
How do I fix CVE-2025-64148?
To fix CVE-2025-64148, update the Jenkins Publish to Bitbucket Plugin to version 0.5 or later.
What specific versions of the Jenkins Publish to Bitbucket Plugin are affected by CVE-2025-64148?
CVE-2025-64148 affects Jenkins Publish to Bitbucket Plugin versions 0.4 and earlier.
What can attackers do with CVE-2025-64148?
Attackers with Overall/Read permission can enumerate credential IDs stored in Jenkins due to the missing permission check.
Is my Jenkins environment at risk with CVE-2025-64148?
If you are using Jenkins Publish to Bitbucket Plugin version 0.4 or earlier, your Jenkins environment is at risk with CVE-2025-64148.