What’s Vulnerable › Vulnerabilities

CVE-2024-28152

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-06 · updated 2026-06-17
• Weakness: CWE-281

Description

In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.

Affected products

• Jenkins project Jenkins Bitbucket Branch Source Plugin: before 848.850.v6a_a_2a_234a_c81; 856.v04c46c86f911, 866.vdea_7dcd3008e — fixed in 848.850.v6a_a_2a_234a_c81

How to fix

Upgrade to a fixed version: Jenkins project Jenkins Bitbucket Branch Source Plugin 848.850.v6a_a_2a_234a_c81. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/03/06/3
• https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300
• http://www.openwall.com/lists/oss-security/2024/03/06/3
• https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300

Get alerted when CVE-2024-28152 or the next vulnerability affects your stack