CVE-2025-64149: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Other sources
Jenkins Publish to Bitbucket Plugin 0.4 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64149?
CVE-2025-64149 is classified as a critical vulnerability due to its potential for credential exposure.
How do I fix CVE-2025-64149?
To mitigate CVE-2025-64149, upgrade the Jenkins Publish to Bitbucket Plugin to version 0.5 or later.
What type of vulnerability is CVE-2025-64149?
CVE-2025-64149 is a cross-site request forgery (CSRF) vulnerability.
Who is affected by CVE-2025-64149?
CVE-2025-64149 affects users of Jenkins Publish to Bitbucket Plugin version 0.4 and earlier.
What are the implications of CVE-2025-64149?
CVE-2025-64149 allows attackers to connect to an attacker-specified URL using captured credentials from Jenkins.