CVE-2025-64150: CSRF
A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Other sources
Jenkins Publish to Bitbucket Plugin 0.4 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64150?
CVE-2025-64150 is classified as a high-severity vulnerability due to its potential impact on Jenkins credentials.
How do I fix CVE-2025-64150?
To fix CVE-2025-64150, upgrade to a version of Jenkins Publish to Bitbucket Plugin later than 0.4 that contains the necessary permission checks.
What kind of attacks can occur due to CVE-2025-64150?
CVE-2025-64150 allows attackers with Overall/Read permission to potentially capture sensitive credentials stored in Jenkins.
Which versions of the Jenkins Publish to Bitbucket Plugin are affected by CVE-2025-64150?
CVE-2025-64150 affects all versions of the Jenkins Publish to Bitbucket Plugin up to and including version 0.4.
What permissions are required to exploit CVE-2025-64150?
To exploit CVE-2025-64150, an attacker must have Overall/Read permission within Jenkins.