Jenkins · Jenkins Bitbucket Branch Source Plugin · CVE-2024-28152
**Name of the Vulnerable Software and Affected Versions**
Jenkins Bitbucket Branch Source Plugin versions 866.vdea 7dcd3008e and earlier, except version 848.850.v6a a 2a 234a c81
**Description**
The issue allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server and the trust policy "Forks in the same account" is in place. This occurs when discovering pull requests from forks.
**Recommendations**
For versions 866.vdea 7dcd3008e and earlier, except version 848.850.v6a a 2a 234a c81, consider restricting the use of the "Forks in the same account" trust policy until a fix is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.