CVE-2025-64148
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Risk Assessment
The risk is the disclosure of credential IDs, which could facilitate further attacks such as credential theft or unauthorized access to systems. This could lead to confidentiality and integrity compromise.
Recommendation
Update Jenkins Publish to Bitbucket Plugin to a version that includes a fix. Also restrict user permissions so that only trusted individuals have read access.
Other vulnerabilities in Jenkins Publish to Bitbucket Plugin
See all- CVE-2025-64150Medium
The Jenkins Publish to Bitbucket plugin version 0.4 and earlier has a missing permission check. An attacker with Overall/Read permission can connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- CVE-2025-64149Medium
The Jenkins Publish to Bitbucket Plugin version 0.4 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Original NVD description (English source)
A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS