Improper handling of untrusted branches in Gitea Jenkins Plugin

ALTO 7.5CVE-2019-10330 · GHSA-q98c-rqx7-7ghf · Published 31/05/2019 · updated 17/06/2026

In breve

CVE-2019-10330 è una vulnerabilità ALTO (CVSS 7.5) che riguarda org.jenkins-ci.plugins:gitea, gitea (gitea).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.1%, superiore al 82.0% delle vulnerabilità.
Correzione: aggiornare a 1.1.2 o successiva.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:gitea Maven	`< 1.1.2`	`1.1.2`
gitea gitea	`≤ 1.1.1`	No fix yet

Description

Jenkins Gitea Plugin prior to 1.1.2 did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.

NVD description

Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.

References

nvd.nist.gov/vuln/detail/CVE-2019-10330 · ADVISORY
jenkinsci/gitea-plugin commit 7555cb7 · WEB
jenkins.io/security/advisory/2019-05-31 · WEB
openwall.com/lists/oss-security/2019/05/31/2 · WEB
securityfocus.com/bid/108540 · WEB

Altre vulnerabilità di org.jenkins-ci.plugins:gitea

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:gitea

Maven

< 1.1.2

1.1.2

gitea

≤ 1.1.1

No fix yet

Description

NVD description