CVE-2025-64150
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Jenkins Publish to Bitbucket plugin version 0.4 and earlier has a missing permission check. An attacker with Overall/Read permission can connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Risk Assessment
The risk is the potential theft of credentials stored in Jenkins, which could lead to unauthorized access to other systems and data.
Recommendation
It is recommended to immediately update the Publish to Bitbucket plugin to the latest version that includes the fix for the missing permission check.
Other vulnerabilities in Jenkins Publish to Bitbucket Plugin
See all- CVE-2025-64149Medium
The Jenkins Publish to Bitbucket Plugin version 0.4 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- CVE-2025-64148Medium
A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Original NVD description (English source)
A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS