CVE-2025-64148: Jenkins Publish to Bitbucket Plugin Lacks Permissions Check
Summary
CVE-2025-64148: Jenkins Publish to Bitbucket Plugin is missing a permissions check. Affects org.jenkins-ci.plugins:publish-to-bitbucket versions < 0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Publish to Bitbucket Plugin is an integration tool that allows Jenkins users to publish their build artifacts directly to Bitbucket repositories. This plugin is widely used in CI/CD pipelines to streamline the deployment process. However, versions 0.4 and earlier of this plugin are vulnerable due to a lack of proper permissions checks, which can expose sensitive information.
Vulnerability Detail
The vulnerability arises from the absence of a permissions check in a method responsible for form validation within the Jenkins Publish to Bitbucket Plugin. This flaw allows attackers with Overall/Read permission to enumerate the IDs of credentials stored in Jenkins. If exploited, this could lead to credential theft through other vulnerabilities, posing a significant security risk to the Jenkins environment.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk, consider restricting Overall/Read permissions for users who do not need access to sensitive credentials. Additionally, review and limit the credentials stored in Jenkins to minimize exposure.
Conclusion
The Jenkins Publish to Bitbucket Plugin is vulnerable due to a lack of permissions checks, allowing unauthorized users to enumerate sensitive credential IDs. While no fix is currently available, users should take precautions to limit access and monitor for updates. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for org.jenkins-ci.plugins:publish-to-bitbucket →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
The vulnerability affects Jenkins Publish to Bitbucket Plugin versions 0.4 and earlier.
Yes, attackers with Overall/Read permission can exploit this vulnerability to enumerate credential IDs.
As of the publication of this advisory, there is no fix available for this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:publish-to-bitbucket.
