CVE-2024-39460
published 2024-06-26CVE-2024-39460: Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in…
PriorityP420medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.49%
38.7th percentile
Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | bitbucket_branch_source | <= 886.v44cf5e4ecec5 | — |
| jenkins | bitbucket_branch_source_plugin | — | — |
| jenkins | structs_plugin | — | — |
| jenkins | when_structs_plugin | — | — |
| jenkins_project | jenkins_bitbucket_branch_source_plugin | <= 886.v44cf5e4ecec5 | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin
ghsa·2024-06-26
CVE-2024-39460 [MEDIUM] CWE-532 Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin
Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin
Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.
Bitbucket Branch Source Plugin 887.va_d359b_3d2d8d does not include the Bitbucket OAuth access token as part of the Bitbucket URL in the build log.
OSV
Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin
osv·2024-06-26
CVE-2024-39460 [MEDIUM] Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin
Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin
Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.
Bitbucket Branch Source Plugin 887.va_d359b_3d2d8d does not include the Bitbucket OAuth access token as part of the Bitbucket URL in the build log.
Red Hat
jenkins: bitbucket: Improper neutralization of OAuth credentials
vendor_redhat·2024-06-26·CVSS 4.3
CVE-2024-39460 [MEDIUM] CWE-117 jenkins: bitbucket: Improper neutralization of OAuth credentials
jenkins: bitbucket: Improper neutralization of OAuth credentials
Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.
A vulnerability was found in Jenkins Bitbucket. In some cases, it prints the Bitbucket OAuth access token as part of the Bitbucket URL.
Package: jenkins-2-plugins (OpenShift Developer Tools and Services) - Fix deferred
Package: jenkins-2-plugins (Red Hat OpenShift Container Platform 3.11) - Fix deferred
Jenkins
Jenkins Security Advisory 2024-06-26
vendor_jenkins·2024-06-26·CVSS 3.1
CVE-2024-39458 [LOW] Jenkins Security Advisory 2024-06-26
Title: Jenkins Security Advisory 2024-06-26
Jenkins Security Advisory 2024-06-26
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Bitbucket Branch Source
Plugin
Plain Credentials
Plugin
Structs
Plugin
Descriptions
Exposure of secrets through system log in Structs Plugin
SECURITY-3371
/
CVE-2024-39458
Sev
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-06-26
Published