Jenkins Project Jenkins Bitbucket Push And Pull Request Plugin vulnerabilities
3 known vulnerabilities affecting jenkins_project/jenkins_bitbucket_push_and_pull_request_plugin.
Total CVEs
3
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH1MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2023-41937P3HIGHCVSS 7.5≥ 2.4.0, ≤ 2.8.32023-09-06
CVE-2023-41937 [HIGH] CWE-918 CVE-2023-41937: Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values pr
Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.
nvd
CVE-2026-92139P3MEDIUMCVSS 6.5≤ 4.0.12026-09-16
CVE-2026-92139 [MEDIUM] CWE-918 CVE-2026-92139: Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webho
Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.
nvd
CVE-2026-57289P4MEDIUMCVSS 4.8≤ 3.3.82026-06-24
CVE-2026-57289 [MEDIUM] CWE-295 CVE-2026-57289: Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS ce
Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token.
nvd