GitHub Advisoryadvisory · Maven

GHSA-q98c-rqx7-7ghf Improper handling of untrusted branches in Gitea Jenkins Plugin

HIGH Published 2022-05-24 Modified 2023-12-05 Official page ↗
Aliases
CVE-2019-10330
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:gitea
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-693, CWE-862
Reviewed
2022-09-15

Affected packages

• Maven org.jenkins-ci.plugins:gitea: < 1.1.2 → fixed in 1.1.2

Description

Jenkins Gitea Plugin prior to 1.1.2 did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.

Related

Alias · CVE (1)

  • CVE-2019-10330 Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to… vulnerability

Weakness · CWE (2)

  • CWE-693 Protection Mechanism Failure weakness
  • CWE-862 Missing Authorization weakness

References