CVE-2022-28134
Description
Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier lacks permission checks, allowing attackers with Overall/Read permission to create, view, and delete BitBucket Server consumers.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier lacks permission checks, allowing attackers with Overall/Read permission to create, view, and delete BitBucket Server consumers.
Vulnerability
The Bitbucket Server Integration Plugin versions 3.1.0 and earlier do not perform permission checks in several HTTP endpoints [1][2]. This allows any attacker with Overall/Read permission to interact with BitBucket Server consumer management endpoints [2]. The plugin is used to integrate Jenkins with Atlassian Bitbucket Server [1].
Exploitation
An attacker needs only Overall/Read permission, which is the default base permission in Jenkins [2]. No further authentication or user interaction is required. The attacker can send crafted HTTP requests to the endpoints to create, view, or delete BitBucket Server consumers [2][4].
Impact
A successful attacker can create, view, or delete BitBucket Server consumers [2][4]. This may lead to unauthorized changes in the integration configuration, potentially redirecting webhooks or accessing build data. The impact is considered Medium severity [2].
Mitigation
Bitbucket Server Integration Plugin version 3.2.0 fixes the issue by requiring Overall/System Read permission to view consumers and Overall/Administer permission to modify them [2]. The update was released on March 29, 2022 [3]. Users should upgrade to version 3.2.0 or later.
AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
io.jenkins.plugins:atlassian-bitbucket-server-integrationMaven | < 3.2.0 | 3.2.0 |
Affected products
2- Range: unspecified
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-r5r6-v8qh-pmpqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-28134ghsaADVISORY
- www.openwall.com/lists/oss-security/2022/03/29/1ghsamailing-listx_refsource_MLISTWEB
- www.jenkins.io/security/advisory/2022-03-29/ghsax_refsource_CONFIRMWEB
News mentions
1- Jenkins Security Advisory 2022-03-29Jenkins Security Advisories · Mar 29, 2022