Bug 2044478 (CVE-2022-20619) - CVE-2022-20619 jenkins-2-plugins/cloudbees-bitbucket-branch-source: no POST request is required for an http endpoint which could allow capturing credentials stored in Jenkins
Summary: CVE-2022-20619 jenkins-2-plugins/cloudbees-bitbucket-branch-source: no POST r...
Keywords:
Status: NEW
Alias: CVE-2022-20619
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2044952 2047839
Blocks: 2044461
TreeView+ depends on / blocked
 
Reported: 2022-01-24 16:59 UTC by Michael Kaplan
Modified: 2024-05-02 18:49 UTC (History)
8 users (show)

Fixed In Version: cloudbees-bitbucket-branch-source 746.v350d2781c184
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Michael Kaplan 2022-01-24 16:59:14 UTC 
A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Reference:

https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2467
Note You need to log in before you can comment on or make changes to this bug.