Cross-Site Request Forgery in Jenkins Bitbucket Branch Source Plugin

高 7.1CVE-2022-20619 · GHSA-w4jv-6rg4-pr4m · 12/01/2022 公開 · 17/06/2026 更新

要点

CVE-2022-20619 は org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source, bitbucket branch source (jenkins) に影響する深刻度「高」 (CVSS 7.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.66%（全脆弱性の 51.4% より高い）。
対処：2.9.11.2, 725.vd9f8be0fa250, 746.v350d2781c184, 2.9.7.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source Maven	`≥ 2.9.8, < 2.9.11.2≥ 720.vbe985dd73d66, < 725.vd9f8be0fa250≥ 726.v7e6f53de133c, < 746.v350d2781c184< 2.9.7.2`	`2.9.11.2725.vd9f8be0fa250746.v350d2781c1842.9.7.2`
bitbucket branch source jenkins	`= 737.vdf9dc06105be≤ 2.9.10`	修正版なし

概要

Jenkins Bitbucket Branch Source Plugin prior to 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Bitbucket Branch Source Plugin 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 requires POST requests for the affected HTTP endpoint.

NVD の説明

A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.