CVE-2024-28152

Опубликовано: 06 мар. 2024

Источник: nvd

CVSS3: 6.3

EPSS Низкий

Описание

In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.

Ссылки

http://www.openwall.com/lists/oss-security/2024/03/06/3
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300
Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/03/06/3
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:jenkins:bitbucket_branch_source:*:*:*:*:*:jenkins:*:*

Версия до 848.850.v6a_a_2a_234a_c81 (исключая)

cpe:2.3:a:jenkins:bitbucket_branch_source:856.v04c46c86f911:*:*:*:*:jenkins:*:*

cpe:2.3:a:jenkins:bitbucket_branch_source:866.vdea_7dcd3008e:*:*:*:*:jenkins:*:*

EPSS

Процентиль: 9%

0.00033

Низкий

6.3 Medium

CVSS3

Дефекты

CWE-281

Связанные уязвимости

CVE-2024-28152

CVSS3: 6.3

redhat

почти 2 года назад

GHSA-m4rm-x2rr-357w

CVSS3: 6.3

github

почти 2 года назад

Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests

EPSS

Процентиль: 9%

0.00033

Низкий

6.3 Medium

CVSS3

Дефекты

CWE-281