4.8

CVE-2026-57289

EPSS 0.11%
Veröffentlicht 24.06.2026 13:20:09
Zuletzt bearbeitet 26.06.2026 19:59:46
Quelle jenkinsci-cert@googlegroups.co
CVE-Watchlists
Login
Unerledigt
Login

Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

NVD 1 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Jenkins ≫ Bitbucket Push And Pull Request SwPlatformjenkins Version < 3.3.9

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.11%	0.014

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	4.8	2.2	2.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3856

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2026-57289

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-57289

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-57289

EUVD