cve.bz

CVE-2024-28152

6.3 mediumEPSS 0.6%

Medium (6.3) in jenkins bitbucket branch source. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 871.v28d74e8b_4226.

In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.

Severity

CVSS 3.1

6.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
EPSS
0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE
CWE-281
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-m4rm-x2rr-357wMavenorg.jenkins-ci.plugins:cloudbees-bitbucket-branch-source<871.v28d74e8b_4226871.v28d74e8b_4226

References

Check your stackJSON