CVEvulnerability
CVE-2019-10330
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-05-31
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-862
Description
Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.
Affected configurations
• gitea gitea (<= 1.1.1)
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- http://www.openwall.com/lists/oss-security/2019/05/31/2 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108540 Third Party Advisory, VDB Entry
- https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1046 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2019/05/31/2 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108540 Third Party Advisory, VDB Entry
- https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1046 Vendor Advisory