CVE-2025-64150: Jenkins Publish to Bitbucket Plugin Lacks Permissions Check Leading to Credential Exposure
Summary
CVE-2025-64150: Jenkins Publish to Bitbucket Plugin is missing a permissions check. Affects org.jenkins-ci.plugins:publish-to-bitbucket versions < 0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Publish to Bitbucket Plugin is an extension for Jenkins that facilitates the integration of Jenkins with Bitbucket, allowing users to publish their builds and manage repositories directly from Jenkins. This plugin is widely used in CI/CD pipelines to automate the deployment process. However, versions 0.4 and earlier of this plugin are vulnerable due to a lack of proper permission checks, which can lead to unauthorized access to sensitive credentials.
Vulnerability Detail
The vulnerability arises from the absence of a permissions check in an HTTP endpoint of the Jenkins Publish to Bitbucket Plugin. Attackers with Overall/Read permission can exploit this flaw to connect to an attacker-specified HTTP URL using credentials IDs that they have obtained through other means. This can result in the unauthorized capture of credentials stored in Jenkins. Furthermore, the endpoint does not enforce POST requests, making it susceptible to cross-site request forgery (CSRF) attacks, which can further compromise the security of the Jenkins environment.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk until a fix is available, users should restrict access to the Jenkins instance and ensure that only trusted users have Overall/Read permissions. Additionally, consider disabling the affected plugin if it is not essential for your operations.
Conclusion
The Jenkins Publish to Bitbucket Plugin is currently vulnerable due to a lack of permission checks, which can lead to unauthorized access to sensitive credentials. Users should monitor for updates and apply necessary workarounds to mitigate risks until a fix is released.
See every vulnerability recorded for org.jenkins-ci.plugins:publish-to-bitbucket →
FAQ
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
The vulnerability affects Jenkins Publish to Bitbucket Plugin versions 0.4 and earlier.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your pom.xml file, you can check for vulnerabilities without needing to install any software.
If you cannot update the plugin, restrict access to your Jenkins instance and limit Overall/Read permissions to trusted users as a temporary measure.
To prevent CSRF attacks, ensure that CSRF protection is enabled in Jenkins and educate users about the risks of clicking on untrusted links.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:publish-to-bitbucket.
