CyberSec.Space Logo
Back to CVE Browser

CVE-2025-64150

MEDIUM
5.4
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-10-29
Last Modified2026-06-17
Data SourcesNVD

Vulnerability Description

A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected Platforms (CPE)

📦
Jenkins

Publish To Bitbucket

<= 0.4

References & Advisories

🔗 https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3576
🔗 http://www.openwall.com/lists/oss-security/2025/10/29/2

Related Vulnerabilities

CVE-2026-174342.1

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-...

CVE-2026-6601210.0

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a gen...

CVE-2026-644237.8

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device ...

CVE-2026-644187.8

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix shrinker_info teardown race with expansion ...