CVE-2024-39460 Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin
Attackers can read Bitbucket OAuth access tokens from build logs, potentially compromising Bitbucket accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39460?
CVE-2024-39460 is a medium-severity vulnerability in Jenkins Bitbucket Branch Source Plugin, published on 26 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.
Weakness: CWE-532
Which versions are affected by CVE-2024-39460?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source Maven | All versions | 887.va |
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source Maven | All versions | 887.va |
Products include Jenkins Bitbucket Branch Source.
How do I fix CVE-2024-39460?
Upgrade org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source to 887.va or later.
Is CVE-2024-39460 being exploited?
There is no known exploitation of CVE-2024-39460 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Bitbucket Branch Source Plugin
- CVE-2022-20619 Cross-Site Request Forgery in Jenkins Bitbucket Branch Source Plugin
- CVE-2024-28152 Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests
- CVE-2022-20618 Incorrect Permission Assignment for Critical Resource in Jenkins Bitbucket Branch Source Plugin
Sources
Also known as GHSA-x8mf-jcmf-r79f.