CVE-2024-28152
Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests
In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.
- Record
CVE-2024-28152- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-281
- Updated
- 2026-11-02
EUVDEUVD-2024-0958
In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.
- Record
EUVD-2024-0958- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m4rm-x2rr-357w
Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests
In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.
- Record
GHSA-m4rm-x2rr-357w- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-281
- Updated
- 2026-11-02
NVD
In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.
- Record
CVE-2024-28152- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-281
- Updated
- 2026-11-02
OSV
In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.
- Record
CVE-2024-28152- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVGHSA-m4rm-x2rr-357w
Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests
In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.
- Record
GHSA-m4rm-x2rr-357w- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-281
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-sourceMaven |
before 871.v28d74e8b4226 | 871.v28d74e8b4226 |
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-sourceMaven |
before 871.v28d74e8b_4226, plus listed versions 1.31.41.51.71.8 Show 45 moreShow less1.92.0.02.0.0-beta-12.0.12.0.22.0.2-beta-12.1.02.1.12.1.1-beta-12.1.22.2.02.2.0-alpha-12.2.0-alpha-42.2.0-beta-12.2.12.2.102.2.112.2.122.2.132.2.142.2.152.2.162.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.4.02.4.12.4.22.4.32.4.42.4.52.4.62.5.02.6.02.7.02.8.02.9.02.9.12.9.10 |
871.v28d74e8b_4226 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-28152 is a medium vulnerability (CVSS 6.3) in Jenkins Bitbucket Branch Source, published March 6, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 871.v28d74e8b4226.
References
jenkins.io/security/advisory/2024-03-06
openwall.com/lists/oss-security/2024/03/06/3
nvd.nist.gov/vuln/detail/CVE-2024-28152
github.com/jenkinsci/bitbucket-branch-source-plugin/commit/28d74e8b4226bfc7524b412e34f7090784cc1a08
Left out here: 42 versions. The JSON record has them.