Skip to content

Commit 5e43cbf

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-hv42-crpx-q355 GHSA-m244-6mff-p355 GHSA-v549-7pm5-f8qr GHSA-wpr5-rc2j-99p2 GHSA-hv42-crpx-q355 GHSA-m244-6mff-p355 GHSA-v549-7pm5-f8qr GHSA-wpr5-rc2j-99p2
1 parent 53df4b5 commit 5e43cbf

File tree

8 files changed

+244
-144
lines changed

8 files changed

+244
-144
lines changed

‎advisories/github-reviewed/2025/10/GHSA-hv42-crpx-q355/GHSA-hv42-crpx-q355.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hv42-crpx-q355",
4+
"modified": "2025-10-29T22:10:15Z",
5+
"published": "2025-10-29T15:31:57Z",
6+
"aliases": [
7+
"CVE-2025-64147"
8+
],
9+
"summary": "Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form",
10+
"details": "Jenkins Curseforge Publisher Plugin 1.0 and earlier stores API Keys unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.\n\nThese keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.\n\nAdditionally, the job configuration form does not mask these keys, increasing the potential for attackers to observe and capture them.\n\nAs of publication of this advisory, there is no fix.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.plugins:curseforge-publisher"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "1.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64147"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/jenkinsci/curseforge-publisher-plugin"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3562"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-311"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-10-29T22:10:14Z",
59+
"nvd_published_at": "2025-10-29T14:15:59Z"
60+
}
61+
}

‎advisories/github-reviewed/2025/10/GHSA-m244-6mff-p355/GHSA-m244-6mff-p355.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m244-6mff-p355",
4+
"modified": "2025-10-29T22:11:04Z",
5+
"published": "2025-10-29T15:31:57Z",
6+
"aliases": [
7+
"CVE-2025-64149"
8+
],
9+
"summary": "Jenkins Publish to Bitbucket Plugin vulnerable to CSRF and missing permissions check",
10+
"details": "Jenkins Publish to Bitbucket Plugin 0.4 and earlier does not perform a permission check in an HTTP endpoint.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.\n\nAdditionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nAs of publication of this advisory, there is no fix.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.plugins:publish-to-bitbucket"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64149"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/jenkinsci/publish-to-bitbucket-plugin"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3576"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-352"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-10-29T22:11:04Z",
59+
"nvd_published_at": "2025-10-29T14:15:59Z"
60+
}
61+
}

‎advisories/github-reviewed/2025/10/GHSA-v549-7pm5-f8qr/GHSA-v549-7pm5-f8qr.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v549-7pm5-f8qr",
4+
"modified": "2025-10-29T22:10:40Z",
5+
"published": "2025-10-29T15:31:57Z",
6+
"aliases": [
7+
"CVE-2025-64148"
8+
],
9+
"summary": "Jenkins Publish to Bitbucket Plugin is missing a permissions check",
10+
"details": "Jenkins Publish to Bitbucket Plugin 0.4 and earlier does not perform a permission check in a method implementing form validation.\n\nThis allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.\n\nAs of publication of this advisory, there is no fix.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.plugins:publish-to-bitbucket"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64148"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/jenkinsci/publish-to-bitbucket-plugin"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3570"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-862"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-10-29T22:10:40Z",
59+
"nvd_published_at": "2025-10-29T14:15:59Z"
60+
}
61+
}

‎advisories/github-reviewed/2025/10/GHSA-wpr5-rc2j-99p2/GHSA-wpr5-rc2j-99p2.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wpr5-rc2j-99p2",
4+
"modified": "2025-10-29T22:11:30Z",
5+
"published": "2025-10-29T15:31:57Z",
6+
"aliases": [
7+
"CVE-2025-64150"
8+
],
9+
"summary": "Jenkins Publish to Bitbucket Plugin is missing a permissions check",
10+
"details": "Jenkins Publish to Bitbucket Plugin 0.4 and earlier does not perform a permission check in an HTTP endpoint.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.\n\nAdditionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nAs of publication of this advisory, there is no fix.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.plugins:publish-to-bitbucket"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64150"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/jenkinsci/publish-to-bitbucket-plugin"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3576"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-862"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-10-29T22:11:30Z",
59+
"nvd_published_at": "2025-10-29T14:15:59Z"
60+
}
61+
}

‎advisories/unreviewed/2025/10/GHSA-hv42-crpx-q355/GHSA-hv42-crpx-q355.json‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

‎advisories/unreviewed/2025/10/GHSA-m244-6mff-p355/GHSA-m244-6mff-p355.json‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

‎advisories/unreviewed/2025/10/GHSA-v549-7pm5-f8qr/GHSA-v549-7pm5-f8qr.json‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

0 commit comments

Comments
 (0)