High severity · published Sep 6, 2023
CVE-2023-41937
Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured…
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
Bitbucket Push And Pull Request · Jenkins
2.4.0 through 2.8.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-41937
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-41937
Mailing List
http://www.openwall.com/lists/oss-security/2023/09/06/9
Vendor Advisory
https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3165
More from Bitbucket Push And Pull Request
4.8
CVE-2026-57289
Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token…