CVE-2023-41937

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-06 · updated 2026-06-17
Weakness: CWE-918

Description

Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.

Affected products

Jenkins Project Jenkins Bitbucket Push and Pull Request Plugin: from 2.4.0 through 2.8.3

References

http://www.openwall.com/lists/oss-security/2023/09/06/9
https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3165
http://www.openwall.com/lists/oss-security/2023/09/06/9
https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3165

Get alerted when CVE-2023-41937 or the next vulnerability affects your stack