Read the docs
TI-2022-05178 Aliases CVE-2022-20619GHSA-w4jv-6rg4-pr4m

Cross-site request forgery in Jenkins Bitbucket Branch Source Plugin

Priority LOW 32CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · Low · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-352.

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Why it matters now

EPSS 0.00676 52nd percentileScored 2026-11-07
Fix Partial Jenkins Bitbucket Branch Source Plugin (Jenkins project): 725.vd9f8be0fa250, 2.9.11.2, 2.9.7.2org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven): 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2 +1Red Hat: 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Bitbucket Branch Source Pluginup to 737.vdf9dc06105be725.vd9f8be0fa250, 2.9.11.2, 2.9.7.2Patch availableCNA
—org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven)726.v7e6f53de133c to before 746.v350d2781c184746.v350d2781c184Patch availableGHSA-w4jv-6rg4-pr4m
—org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven)720.vbe985dd73d66 to before 725.vd9f8be0fa250725.vd9f8be0fa250Patch availableGHSA-w4jv-6rg4-pr4m
—org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven)2.9.8 to before 2.9.11.22.9.11.2Patch availableGHSA-w4jv-6rg4-pr4m
—org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven)before 2.9.7.22.9.7.2Patch availableGHSA-w4jv-6rg4-pr4m
  • Jenkins Bitbucket Branch Source Plugin VendorJenkins Affected up to 737.vdf9dc06105be Fixed in 725.vd9f8be0fa250, 2.9.11.2, 2.9.7.2 Patch available CNA
  • org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Vendor— Affected 726.v7e6f53de133c to before 746.v350d2781c184 Fixed in 746.v350d2781c184 Patch available GHSA-w4jv-6rg4-pr4m
  • org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Vendor— Affected 720.vbe985dd73d66 to before 725.vd9f8be0fa250 Fixed in 725.vd9f8be0fa250 Patch available GHSA-w4jv-6rg4-pr4m
  • org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Vendor— Affected 2.9.8 to before 2.9.11.2 Fixed in 2.9.11.2 Patch available GHSA-w4jv-6rg4-pr4m
  • org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Vendor— Affected before 2.9.7.2 Fixed in 2.9.7.2 Patch available GHSA-w4jv-6rg4-pr4m

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:bitbucket_branch_source:*:*:*:*:*:jenkins:*:*up to 2.9.10VulnerableJenkins
cpe:2.3:a:jenkins:bitbucket_branch_source:737.vdf9dc06105be:*:*:*:*:jenkins:*:*737.vdf9dc06105beVulnerableJenkins
  • cpe:2.3:a:jenkins:bitbucket_branch_source:*:*:*:*:*:jenkins:*:* Versions up to 2.9.10 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:bitbucket_branch_source:737.vdf9dc06105be:*:*:*:*:jenkins:*:* Versions 737.vdf9dc06105be Vulnerable ·Jenkins

Remediation

  • Fix · CNA Jenkins Bitbucket Branch Source Plugin (Jenkins project) Fixed in 725.vd9f8be0fa250, 2.9.11.2, 2.9.7.2
  • Fix · GHSA-w4jv-6rg4-pr4m org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Fixed in 746.v350d2781c184 Advisory →
  • Fix · GHSA-w4jv-6rg4-pr4m org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Fixed in 725.vd9f8be0fa250 Advisory →
  • Fix · GHSA-w4jv-6rg4-pr4m org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Fixed in 2.9.11.2 Advisory →
  • Fix · GHSA-w4jv-6rg4-pr4m org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Fixed in 2.9.7.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-20619
  2. 2026-10-03 Alias added: GHSA-w4jv-6rg4-pr4m
  3. 2026-10-13 EPSS moved to the 50th–90th percentile

References

Advisory 3

Other 3

  • TI-2024-18730 In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except… CVSS 3.1MEDIUM 6.3
  • TI-2022-05177 Missing authorization in Jenkins Bitbucket Branch Source Plugin CVSS 3.1MEDIUM 4.3
  • TI-2024-26395 Sensitive information in log files in Jenkins Bitbucket Branch Source Plugin CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences