What is CVE-2023-41937?

CVE-2023-41937 is a high-severity vulnerability in Jenkins Bitbucket_push_and_pull_request, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2023-09-06.

How severe is CVE-2023-41937?

High severity. CVSS v3 base score is 7.5 out of 10.

SSRF in Jenkins Bitbucket_push_and_pull_request

CVE-2023-41937

Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attacke…

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.006 (43.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Jenkins Bitbucket_push_and_pull_request
Jenkins Project Bitbucket Push And Pull Request Plugin — versions 2.4.0

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

jenkinsci-cert@googlegroups.com (vendor-advisory, Vendor Advisory)
jenkinsci-cert@googlegroups.com (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2023-41937?: CVE-2023-41937 is a high-severity vulnerability in Jenkins Bitbucket_push_and_pull_request, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2023-09-06.
How severe is CVE-2023-41937?: High severity. CVSS v3 base score is 7.5 out of 10.