Improper handling of untrusted branches in Gitea Jenkins Plugin

HIGH 7.5CVE-2019-10330 · GHSA-q98c-rqx7-7ghf · Published 31/05/2019 · updated 17/06/2026

In short

CVE-2019-10330 is a HIGH (CVSS 7.5) vulnerability affecting org.jenkins-ci.plugins:gitea, gitea (gitea).
Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 82.0% of all vulnerabilities.
Fix: update to 1.1.2 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:gitea Maven	`< 1.1.2`	`1.1.2`
gitea gitea	`≤ 1.1.1`	No fix yet

Description

Jenkins Gitea Plugin prior to 1.1.2 did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.

NVD description

Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.

References

nvd.nist.gov/vuln/detail/CVE-2019-10330 · ADVISORY
jenkinsci/gitea-plugin commit 7555cb7 · WEB
jenkins.io/security/advisory/2019-05-31 · WEB
openwall.com/lists/oss-security/2019/05/31/2 · WEB
securityfocus.com/bid/108540 · WEB

More vulnerabilities in org.jenkins-ci.plugins:gitea

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free