Jenkins Publish to Bitbucket Plugin vulnerabilities

The Jenkins Publish to Bitbucket plugin version 0.4 and earlier has a missing permission check. An attacker with Overall/Read permission can connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

The Jenkins Publish to Bitbucket Plugin version 0.4 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.