Jenkins Bitbucket Server Integration vulnerabilities

3 CVEs affecting Jenkins Bitbucket Server Integration, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-24398, published 2025-01-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-28133, published 2022-03-29. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting (XSS) vulnerability…
CVE-2022-28134, published 2022-03-29. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to create, view, and delete…
CVE-2025-24398, published 2025-01-22. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.