CVE-2025-64149
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Jenkins Publish to Bitbucket Plugin version 0.4 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Risk Assessment
An attacker can exploit CSRF to capture credentials stored in Jenkins, potentially leading to unauthorized access to systems and data.
Recommendation
Update the Jenkins Publish to Bitbucket Plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Jenkins Publish to Bitbucket Plugin
See all- CVE-2025-64150Medium
The Jenkins Publish to Bitbucket plugin version 0.4 and earlier has a missing permission check. An attacker with Overall/Read permission can connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- CVE-2025-64148Medium
A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Original NVD description (English source)
A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS