-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source | maven | < 871.v28d74e8b4226 | 871.v28d74e8b_4226 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper permission preservation (CWE-281) when handling pull requests from forks. The commit diff shows critical changes in pull request handling logic:- In BitbucketGitSCMBuilder.java, the withPullRequestRemote() method determines cloning strategy but previously didn't properly validate() if the user had write access when using same-account forks.- In BitbucketSCMSource.java, the initCloneLinks() method's mirror handling could bypass permission checks. The patched version adds proper validation() for contributor permissions when using mirrors, indicating these were the vulnerable areas.