-
Type:
Bug
-
Resolution: Fixed
-
Priority:
Major
-
Component/s: atlassian-bitbucket-server-integration-plugin
-
Environment:Jenkins 2.492.1
Bitbucket Server Integration Plugin 4.1.4
Bitbucket Server v7.21.6
The build now action in Bitbucket (see below) can't be initiated in Bitbucket Server Integration Plugin 4.1.4.


I believe this is because version 4.1.4 fixes Jenkins Security Advisory 2025-01-22. However, CSRF protection is not disabled for this URL.
Jenkins responds with the following:

Bitbucket doesn't have access to the crumb generated by Jenkins in the Jenkins user's session and therefore can't provide it in the Jenkins-Crumb header.
Rolling back the plugin to version 4.1.3 fixes this issue, but doesn't include the security fixes from 4.1.4