CVE-2025-24398

8.8 highEPSS 0.3%

High (8.8) in jenkins bitbucket server integration. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in io.jenkins.plugins:atlassian-bitbucket-server-integration 4.1.4.

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2025-01-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jenkins:bitbucket_server_integration

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-qjw6-xvrm-5f2h	Maven	io.jenkins.plugins:atlassian-bitbucket-server-integration	>=2.1.0 <4.1.4	4.1.4

References

https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3434

Check your stack JSON