Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2019-1003057: Jenkins Bitbucket Approve Plugin stores sensitive credentials insecurely
CVE-2019-1003057 · published 7 years ago
Summary
The Jenkins Bitbucket Approve Plugin stores Bitbucket credentials in plain text. This means that anyone with access to the Jenkins master server can read these credentials, potentially allowing unauthorized access to your Bitbucket account. To protect your credentials, update the plugin to a version that stores them securely, or take steps to restrict access to the Jenkins master server.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | jenkins-ci | org.jenkins-ci.plugins:bitbucket-approve | <= 1.0.3 |
| – | jenkins | bitbucket_approve |
All versions
cpe:2.3:a:jenkins:bitbucket_approve:*:*:*:*:*:jenkins:*:* |
Original advisory text
Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
8.8
High
Type
CWE-311Missing Encryption of Sensitive Data
Timeline
Published4 Apr 2019
Updated2 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta