{"id":"GHSA-m4rm-x2rr-357w","summary":"Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests","details":"In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy \"Forks in the same account\" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.","aliases":["CVE-2024-28152"],"modified":"2024-11-07T19:22:05.678027Z","published":"2024-03-06T18:30:38Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-03-06T19:20:57Z","nvd_published_at":"2024-03-06T17:15:10Z","cwe_ids":["CWE-281"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28152"},{"type":"WEB","url":"https://github.com/jenkinsci/bitbucket-branch-source-plugin/commit/28d74e8b4226bfc7524b412e34f7090784cc1a08"},{"type":"PACKAGE","url":"https://github.com/jenkinsci/bitbucket-branch-source-plugin"},{"type":"WEB","url":"https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2024/03/06/3"}],"affected":[{"package":{"name":"org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source","ecosystem":"Maven","purl":"pkg:maven/org.jenkins-ci.plugins/cloudbees-bitbucket-branch-source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"871.v28d74e8b_4226"}]}],"versions":["1.3","1.4","1.5","1.7","1.8","1.9","2.0.0","2.0.0-beta-1","2.0.1","2.0.2","2.0.2-beta-1","2.1.0","2.1.1","2.1.1-beta-1","2.1.2","2.2.0","2.2.0-alpha-1","2.2.0-alpha-4","2.2.0-beta-1","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1","2.9.10","2.9.11","2.9.11.2","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.7.2","2.9.8","2.9.9","723.vbabdf19eb4c7","725.vd9f8be0fa250","726.vb0c1ea6c9336","731.v1f980b7eba32","734.v2f848c5e6ea2","737.vdf9dc06105be","746.v350d2781c184","751.vda_24678a_f781","756.v081ee2205040","757.vddedc5f2589a_","762.v969cfe087fc0","765.v5a_2d6a_23c01d","773.v4b_9b_005b_562b_","784.v7fcdc7c670f6","785.ve724eb_44e286","791.vb_eea_a_476405b","796.v6cb_1559e1673","800.va_b_b_9a_a_5035c1","803.vd9c5e84c41fa_","804.v8b_0642650b_d2","805.v7f97d29dc0f5","809.vc1d904b_30426","820.v30b_e8c1e36f3","825.va_6a_dc46a_f97d","832.v43175a_425ea_6","843.vd09104df7988","845.v27a_d5823911b_","848.850.v6a_a_2a_234a_c81","848.v42c6a_317eda_e","856.v04c46c86f911","866.vdea_7dcd3008e"],"database_specific":{"last_known_affected_version_range":"\u003c 871.v28d74e8b4226","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-m4rm-x2rr-357w/GHSA-m4rm-x2rr-357w.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}