Threats tagged 'ghsa-m244-6mff-p355'

The Jenkins Publish to Bitbucket Plugin version 0.4 and earlier contains a vulnerability where an HTTP endpoint does not perform proper permission checks. This flaw allows attackers with Overall/Read permission to connect to attacker-controlled URLs using credentials IDs obtained by other means, potentially exposing stored Jenkins credentials. The endpoint also lacks enforcement of POST requests, leading to a cross-site request forgery (CSRF) vulnerability. No fix is currently available for this issue.