CVE-2022-20619: Jenkins Bitbucket Branch Source

High severity, CVSS 7.1. EPSS: 0.7% chance of exploitation in the next 30 days.

A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected products

• Jenkins Bitbucket Branch Source: up to and including 2.9.10; version 737.vdf9dc06105be only

Published 2022-01-12. Last modified 2026-06-17.