{"id":"CVE-2024-39460","aliases":["EUVD-2024-2206","GHSA-x8mf-jcmf-r79f"],"status":"published","title":"Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin","description":"Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00489,"percentile":0.42422,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2024-06-26T17:06:27Z","modified":"2026-10-24T10:30:59Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source","fixed_in":["887.va"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"886.v44cf5e4ecec5"},{"fixed":"887.va"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"887.va"}]}],"versions":["1.3","1.4","1.5","1.7","1.8","1.9","2.0.0","2.0.0-beta-1","2.0.1","2.0.2","2.0.2-beta-1","2.1.0","2.1.1","2.1.1-beta-1","2.1.2","2.2.0","2.2.0-alpha-1","2.2.0-alpha-4","2.2.0-beta-1","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1","2.9.10","2.9.11","2.9.11.2","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.7.2","2.9.8","2.9.9","723.vbabdf19eb4c7","725.vd9f8be0fa250","726.vb0c1ea6c9336","731.v1f980b7eba32","734.v2f848c5e6ea2","737.vdf9dc06105be","746.v350d2781c184","751.vda_24678a_f781","756.v081ee2205040","757.vddedc5f2589a_","762.v969cfe087fc0","765.v5a_2d6a_23c01d","773.v4b_9b_005b_562b_","784.v7fcdc7c670f6","785.ve724eb_44e286","791.vb_eea_a_476405b","796.v6cb_1559e1673","800.va_b_b_9a_a_5035c1","803.vd9c5e84c41fa_","804.v8b_0642650b_d2","805.v7f97d29dc0f5","809.vc1d904b_30426","820.v30b_e8c1e36f3","825.va_6a_dc46a_f97d","832.v43175a_425ea_6","843.vd09104df7988","845.v27a_d5823911b_","848.850.v6a_a_2a_234a_c81","848.v42c6a_317eda_e","856.v04c46c86f911","866.vdea_7dcd3008e","871.v28d74e8b_4226","872.vb_8fa_89198661","873.v0ed259216f8d","874.v659a_b_70f5e69","876.v857269a_5f439","877.vb_b_d5243f6794","878.v4a_79a_b_946282","880.vcf4056c5a_71f","883.v041fa_695e9c2","886.v44cf5e4ecec5"]}],"products":[{"vendor":"jenkins","product":"bitbucket_branch_source"},{"vendor":"jenkins project","product":"jenkins bitbucket branch source plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-3363","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/06/26/2","tags":["x_transferred","Mailing List","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39460","tags":["advisory"]},{"url":"https://github.com/jenkinsci/bitbucket-branch-source-plugin/commit/ad359b3d2d8d6c114025d81abc59b3c9acb636df","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x8mf-jcmf-r79f"},{"url":"https://github.com/jenkinsci/bitbucket-branch-source-plugin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-39460","description":"Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.","status":"published","published":"2024-06-26T17:06:27.695Z","modified":"2025-02-13T17:53:17.942Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-2206","description":"Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.","status":"published","published":"2024-06-26T17:06:27Z","modified":"2025-02-13T17:53:17Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:31.305109Z"}],"ghsa":[{"id":"GHSA-x8mf-jcmf-r79f","title":"Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin ","description":"Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.\n\nBitbucket Branch Source Plugin 887.va_d359b_3d2d8d does not include the Bitbucket OAuth access token as part of the Bitbucket URL in the build log.\n","status":"published","published":"2024-06-26T18:30:28Z","modified":"2024-06-26T20:00:06Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:37:55.455438Z"}],"nvd":[{"id":"CVE-2024-39460","description":"Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.","status":"published","published":"2024-06-26T17:15:27.18Z","modified":"2026-06-17T07:41:57.503Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:10:09.388795Z"}],"osv":[{"id":"CVE-2024-39460","description":"Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.","status":"published","published":"2024-06-26T17:15:27.18Z","modified":"2026-10-24T10:30:59.067390422Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"GHSA-x8mf-jcmf-r79f","title":"Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin ","description":"Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.\n\nBitbucket Branch Source Plugin 887.va_d359b_3d2d8d does not include the Bitbucket OAuth access token as part of the Bitbucket URL in the build log.\n","status":"published","published":"2024-06-26T18:30:28Z","modified":"2024-06-26T20:13:25.25223Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}