High severity · published Jan 22, 2025
CVE-2025-24398
Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JB
Jenkins Bitbucket Server Integration Plugin · Jenkins Project
2.1.0 through 4.1.3 · source: vendor
BS
Bitbucket Server Integration · Jenkins
2.1.0 before 4.1.4 · source: NVD
Affected product
JB
Jenkins Bitbucket Server Integration Plugin
Jenkins Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24398
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24398
Vendor Advisory
https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3434
More from Jenkins Bitbucket Server Integration Plugin
4.2
CVE-2026-92138
The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather than from the…