VulnerabilityAnalyzed

CVE-2024-39460

Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.

MEDIUM 4.3EPSS 0.49%

Does this matter?

Lower severity and a low EPSS score (0.49%). Track it; it rarely justifies an emergency change on its own.

Description

Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.49% probability · 41th percentile
CISA KEV: Not listed
Weakness: CWE-532
Affected: jenkins/bitbucket branch source
Source: jenkinsci-cert@googlegroups.com

References

http://www.openwall.com/lists/oss-security/2024/06/26/2Mailing List
https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-3363Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/06/26/2Mailing List
https://www.jenkins.io/security/advisory/2024-06-26/#SECURITY-3363Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.