CVE-2023-41937

published 2023-09-06

CVE-2023-41937: Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and…

Priority P3 43 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
jenkins	assembla_auth_plugin	—	—
jenkins	aws_codecommit_trigger_plugin	—	—
jenkins	bitbucket_push_and_pull_request	2.4.0 – 2.8.3	—
jenkins	bitbucket_push_and_pull_request_plugin	—	—
jenkins	config_file_provider_plugin	—	—
jenkins	disabled_permissions_can_be_granted_by_ssh2_easy_plugin	—	—
jenkins	disabled_permissions_granted_by_assembla_auth_plugin	—	—
jenkins	frugal_testing_plugin	—	—
jenkins	google_login_plugin	—	—
jenkins	ivy_plugin	—	—
jenkins	job_configuration_history_plugin	—	—
jenkins	non-constant_time_token_comparison_in_google_login_plugin	—	—
jenkins	pipeline_maven_integration_plugin	—	—
jenkins	qualys_container_scanning_connector_plugin	—	—
jenkins	ssh2_easy_plugin	—	—
jenkins	tap_plugin	—	—
jenkins_project	jenkins_bitbucket_push_and_pull_request_plugin	2.4.0 – 2.8.3	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-918