Headline
GHSA-m244-6mff-p355: Jenkins Publish to Bitbucket Plugin vulnerable to CSRF and missing permissions check
Jenkins Publish to Bitbucket Plugin 0.4 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2025-64149
Jenkins Publish to Bitbucket Plugin vulnerable to CSRF and missing permissions check
Moderate severity GitHub Reviewed Published Oct 29, 2025 to the GitHub Advisory Database • Updated Oct 29, 2025
Package
maven org.jenkins-ci.plugins:publish-to-bitbucket (Maven)
Jenkins Publish to Bitbucket Plugin 0.4 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-64149
- https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3576
Published to the GitHub Advisory Database
Oct 29, 2025
Last updated
Oct 29, 2025