Improper handling of untrusted branches in Gitea Jenkins Plugin

ÉLEVÉE 7.5CVE-2019-10330 · GHSA-q98c-rqx7-7ghf · Published 31/05/2019 · updated 17/06/2026

En bref

CVE-2019-10330 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant org.jenkins-ci.plugins:gitea, gitea (gitea).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.1%, plus élevée que 82.0% des vulnérabilités.
Correctif : mettre à jour vers 1.1.2 ou plus récent.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:gitea Maven	`< 1.1.2`	`1.1.2`
gitea gitea	`≤ 1.1.1`	No fix yet

Description

Jenkins Gitea Plugin prior to 1.1.2 did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.

NVD description

Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.

References

nvd.nist.gov/vuln/detail/CVE-2019-10330 · ADVISORY
jenkinsci/gitea-plugin commit 7555cb7 · WEB
jenkins.io/security/advisory/2019-05-31 · WEB
openwall.com/lists/oss-security/2019/05/31/2 · WEB
securityfocus.com/bid/108540 · WEB

Autres vulnérabilités de org.jenkins-ci.plugins:gitea

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:gitea

Maven

< 1.1.2

1.1.2

gitea

≤ 1.1.1

No fix yet

Description

NVD description