Bug 2044478 (CVE-2022-20619) - CVE-2022-20619 jenkins-2-plugins/cloudbees-bitbucket-branch-source: no POST request is required for an http endpoint which could allow capturing credentials stored in Jenkins
Summary: CVE-2022-20619 jenkins-2-plugins/cloudbees-bitbucket-branch-source: no POST r...
Keywords:
Status: NEW
Alias: CVE-2022-20619
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2044952 2047839
Blocks: 2044461
TreeView+ depends on / blocked
 
Reported: 2022-01-24 16:59 UTC by Michael Kaplan
Modified: 2023-07-07 08:29 UTC (History)
9 users (show)

Fixed In Version: cloudbees-bitbucket-branch-source 746.v350d2781c184
Doc Type: If docs needed, set a value
Doc Text:
A Cross-site request forgery (CSRF) vulnerability was found in the Jenkins Bitbucket Branch Source plugin. In the HTTP endpoint, the POST requests are not required. This flaw allows an attacker with Overall/Read access to connect to an attacker-specified URL (using attacker-specified credentials IDs), capturing credentials stored in Jenkins.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Michael Kaplan 2022-01-24 16:59:14 UTC 
A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Reference:

https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2467
Note You need to log in before you can comment on or make changes to this bug.