CVE-2022-20619

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Bitbucket Branch Source Plugin	>= unspecified, <= 737.vdf9dc06105be

References

http://www.openwall.com/lists/oss-security/2022/01/12/6Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2467Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/01/12/6Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2467Vendor Advisory

Timeline

Published: Jan 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-20627.5Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.CVE-2022-206204.3Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials ID CVE-2022-206215.5Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller where CVE-2022-206227.5A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points Software could allow a CVE-2022-206237.5A vulnerability in the rate limiter for Bidirectional Forwarding Detection (BFD) traffic of Cisco NX-OS Software for Cisco Nexus 9000 Series CVE-2022-206247.5A vulnerability in the Cisco Fabric Services over IP (CFSoIP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacke CVE-2022-206254.3A vulnerability in the Cisco Discovery Protocol service of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adja CVE-2022-206265.4A vulnerability in the web-based management interface of Cisco Prime Access Registrar Appliance could allow an authenticated, remote at CVE-2022-206275.4Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica CVE-2022-206285.4Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica CVE-2022-206295.4Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica CVE-2022-20638.8Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+.