CVE-2025-64149
Medium · 5.4Jenkins Publish to Bitbucket Plugin vulnerable to CSRF and missing permissions check
CVSS
5.4
EPSS
0.2%
Published
Oct 29, 2025
CISA due date
—
The record
Jenkins Publish to Bitbucket Plugin 0.4 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. As of publication of this advisory, there is no fix.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:publish-to-bitbucket | 0 | No fix |
Related vulnerabilities
- CVE-2025-64150 Jenkins Publish to Bitbucket Plugin is missing a permissions check Also affects org.jenkins-ci.plugins:publish-to-bitbucket
- CVE-2025-64148 Jenkins Publish to Bitbucket Plugin is missing a permissions check Also affects org.jenkins-ci.plugins:publish-to-bitbucket
- CVE-2026-96388 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application… CWE-352
- CVE-2026-96374 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross… CWE-352
- CVE-2026-114719 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation… CWE-352
- CVE-2026-114662 Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow… CWE-352
- CVE-2026-111883 Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows… CWE-352
- CVE-2026-62139 Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0… CWE-352