CVE-2024-28152

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-28152
In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/03/06/3 Mailing List Third Party Advisory
https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300 Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/03/06/3 Mailing List Third Party Advisory
https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:jenkins:bitbucket_branch_source:*:*:*:*:*:jenkins:*:*
cpe:2.3:a:jenkins:bitbucket_branch_source:856.v04c46c86f911:*:*:*:*:jenkins:*:*
cpe:2.3:a:jenkins:bitbucket_branch_source:866.vdea_7dcd3008e:*:*:*:*:jenkins:*:*
History

18 Sep 2025, 16:27

Type Values Removed Values Added
CPE cpe:2.3:a:jenkins:bitbucket_branch_source:866.vdea_7dcd3008e:*:*:*:*:jenkins:*:*
cpe:2.3:a:jenkins:bitbucket_branch_source:856.v04c46c86f911:*:*:*:*:jenkins:*:*
cpe:2.3:a:jenkins:bitbucket_branch_source:*:*:*:*:*:jenkins:*:*
First Time Jenkins bitbucket Branch Source
Jenkins
References () http://www.openwall.com/lists/oss-security/2024/03/06/3 - () http://www.openwall.com/lists/oss-security/2024/03/06/3 - Mailing List, Third Party Advisory
References () https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300 - () https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300 - Vendor Advisory

21 Nov 2024, 09:05

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/03/06/3 - () http://www.openwall.com/lists/oss-security/2024/03/06/3 -
References () https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300 - () https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300 -

07 Nov 2024, 15:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.3
CWE CWE-281

01 May 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/03/06/3 -

06 Mar 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-06 17:15

Updated : 2025-09-18 16:27

NVD link : CVE-2024-28152

Mitre link : CVE-2024-28152

CVE.ORG link : CVE-2024-28152

JSON object : View

Products Affected

jenkins

  • bitbucket_branch_source
CWE
CWE-281

Improper Preservation of Permissions