{"id":"CVE-2025-24398","details":"Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.","aliases":["GHSA-qjw6-xvrm-5f2h"],"modified":"2026-07-10T03:06:46.990295Z","published":"2025-01-22T17:15:13.760Z","references":[{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3434"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/atlassian-bitbucket-server-integration-plugin","events":[{"introduced":"3e296850edc2f1ce39ae8ed8bb1c79e8981ae7ea"},{"fixed":"933bf0177594feddb17a73aaa70e452d0a43e17d"}],"database_specific":{"cpe":"cpe:2.3:a:jenkins:bitbucket_server_integration:*:*:*:*:*:jenkins:*:*","extracted_events":[{"introduced":"2.1.0"},{"fixed":"4.1.4"}],"source":"CPE_RANGE"}}],"versions":["atlassian-bitbucket-server-integration-4.1.3","atlassian-bitbucket-server-integration-4.1.2","atlassian-bitbucket-server-integration-4.1.0","atlassian-bitbucket-server-integration-4.0.0","atlassian-bitbucket-server-integration-3.6.0","atlassian-bitbucket-server-integration-3.5.0","atlassian-bitbucket-server-integration-3.4.2","atlassian-bitbucket-server-integration-3.4.1","atlassian-bitbucket-server-integration-3.4.0","atlassian-bitbucket-server-integration-3.3.2","atlassian-bitbucket-server-integration-3.3.1","atlassian-bitbucket-server-integration-3.3.0","atlassian-bitbucket-server-integration-3.2.3","atlassian-bitbucket-server-integration-3.2.2","atlassian-bitbucket-server-integration-3.2.1","atlassian-bitbucket-server-integration-3.2.0","atlassian-bitbucket-server-integration-3.1.0","atlassian-bitbucket-server-integration-3.0.2","atlassian-bitbucket-server-integration-3.0.1","atlassian-bitbucket-server-integration-3.0.0","atlassian-bitbucket-server-integration-2.1.3","atlassian-bitbucket-server-integration-2.1.2","atlassian-bitbucket-server-integration-2.1.1","atlassian-bitbucket-server-integration-2.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24398.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}