CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.

Score

CVSS 3.1 8.8 High

Status

Analyzed - jenkinsci-cert@googlegroups.com

Published

2025-01-22

Last modified

2025-01-23

Weaknesses

CWE-352

Affected products

• Bitbucket Server Integration (Jenkins)
• Jenkins Bitbucket Server Integration Plugin (Jenkins Project)

References

• https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3434