{"id":"CVE-2024-28152","aliases":["EUVD-2024-0958","GHSA-m4rm-x2rr-357w"],"status":"published","title":"Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests","description":"In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy \"Forks in the same account\" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00556,"percentile":0.46626,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-281"],"published":"2024-03-06T17:01:56Z","modified":"2026-10-24T14:56:09Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source","fixed_in":["871.v28d74e8b4226","871.v28d74e8b_4226"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"871.v28d74e8b4226"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"871.v28d74e8b_4226"}]}],"versions":["1.3","1.4","1.5","1.7","1.8","1.9","2.0.0","2.0.0-beta-1","2.0.1","2.0.2","2.0.2-beta-1","2.1.0","2.1.1","2.1.1-beta-1","2.1.2","2.2.0","2.2.0-alpha-1","2.2.0-alpha-4","2.2.0-beta-1","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1","2.9.10","2.9.11","2.9.11.2","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.7.2","2.9.8","2.9.9","723.vbabdf19eb4c7","725.vd9f8be0fa250","726.vb0c1ea6c9336","731.v1f980b7eba32","734.v2f848c5e6ea2","737.vdf9dc06105be","746.v350d2781c184","751.vda_24678a_f781","756.v081ee2205040","757.vddedc5f2589a_","762.v969cfe087fc0","765.v5a_2d6a_23c01d","773.v4b_9b_005b_562b_","784.v7fcdc7c670f6","785.ve724eb_44e286","791.vb_eea_a_476405b","796.v6cb_1559e1673","800.va_b_b_9a_a_5035c1","803.vd9c5e84c41fa_","804.v8b_0642650b_d2","805.v7f97d29dc0f5","809.vc1d904b_30426","820.v30b_e8c1e36f3","825.va_6a_dc46a_f97d","832.v43175a_425ea_6","843.vd09104df7988","845.v27a_d5823911b_","848.850.v6a_a_2a_234a_c81","848.v42c6a_317eda_e","856.v04c46c86f911","866.vdea_7dcd3008e"]}],"products":[{"vendor":"jenkins","product":"bitbucket_branch_source"},{"vendor":"jenkins project","product":"jenkins bitbucket branch source plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/06/3","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28152","tags":["advisory"]},{"url":"https://github.com/jenkinsci/bitbucket-branch-source-plugin/commit/28d74e8b4226bfc7524b412e34f7090784cc1a08","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m4rm-x2rr-357w"},{"url":"https://github.com/jenkinsci/bitbucket-branch-source-plugin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-28152","description":"In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy \"Forks in the same account\" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.","status":"published","published":"2024-03-06T17:01:56.184Z","modified":"2025-02-13T17:47:19.64Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-0958","description":"In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy \"Forks in the same account\" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.","status":"published","published":"2024-03-06T17:01:56Z","modified":"2025-02-13T17:47:19Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:53:31.829035Z"}],"ghsa":[{"id":"GHSA-m4rm-x2rr-357w","title":"Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests","description":"In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy \"Forks in the same account\" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.","status":"published","published":"2024-03-06T18:30:38Z","modified":"2024-11-07T19:18:19Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T14:38:16.477822Z"}],"nvd":[{"id":"CVE-2024-28152","description":"In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy \"Forks in the same account\" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.","status":"published","published":"2024-03-06T17:15:10.637Z","modified":"2026-06-17T07:21:05.797Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T14:09:39.488031Z"}],"osv":[{"id":"CVE-2024-28152","description":"In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy \"Forks in the same account\" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.","status":"published","published":"2024-03-06T17:15:10.637Z","modified":"2026-10-24T14:56:09.029413146Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"GHSA-m4rm-x2rr-357w","title":"Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests","description":"In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy \"Forks in the same account\" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.","status":"published","published":"2024-03-06T18:30:38Z","modified":"2024-11-07T19:22:05.678027Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T15:46:51.463834Z"}]}}