{"id":"CVE-2024-28152","aliases":["GHSA-m4rm-x2rr-357w"],"url":"https://o3.security/vulnerability/CVE-2024-28152","summary":"Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests","details":"In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy \"Forks in the same account\" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.","published":"2024-03-06T17:15:10.637Z","modified":"2026-07-09T14:44:10.454411Z","cvss":{"score":6.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source","fixedVersion":"871.v28d74e8b_4226"}],"fix":null,"references":[{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2024/03/06/3"},{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T14:44:10.454411Z"}}