Improper handling of untrusted branches in Gitea Jenkins Plugin

ALTO 7.5CVE-2019-10330 · GHSA-q98c-rqx7-7ghf · Published 31/05/2019 · updated 17/06/2026

Em resumo

CVE-2019-10330 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta org.jenkins-ci.plugins:gitea, gitea (gitea).
Chance de exploração nos próximos 30 dias (EPSS): 2.1%, maior que 82.0% das vulnerabilidades.
Correção: atualize para 1.1.2 ou posterior.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:gitea Maven	`< 1.1.2`	`1.1.2`
gitea gitea	`≤ 1.1.1`	No fix yet

Description

Jenkins Gitea Plugin prior to 1.1.2 did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.

NVD description

Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.

References

nvd.nist.gov/vuln/detail/CVE-2019-10330 · ADVISORY
jenkinsci/gitea-plugin commit 7555cb7 · WEB
jenkins.io/security/advisory/2019-05-31 · WEB
openwall.com/lists/oss-security/2019/05/31/2 · WEB
securityfocus.com/bid/108540 · WEB

Mais vulnerabilidades de org.jenkins-ci.plugins:gitea

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free