CVE-2019-10330
First published: Fri May 31 2019(Updated: )
Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Gitea Gitea | <=1.1.1 | |
| maven/org.jenkins-ci.plugins:gitea | <1.1.2 | 1.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2019/05/31/2
- http://www.securityfocus.com/bid/108540
- https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1046
- https://nvd.nist.gov/vuln/detail/CVE-2019-10330
- https://github.com/jenkinsci/gitea-plugin/commit/7555cb7c168cfa49d31271e7d65d76c1fab311f7
- https://github.com/advisories/GHSA-q98c-rqx7-7ghf (Advisory)
Frequently Asked Questions
What is CVE-2019-10330?
CVE-2019-10330 is a vulnerability in Jenkins Gitea Plugin 1.1.1 and earlier that allows attackers without commit access to the Git repo to change Jenkinsfiles.
How does CVE-2019-10330 affect Gitea?
CVE-2019-10330 affects Gitea versions up to and including 1.1.1.
What is the severity of CVE-2019-10330?
CVE-2019-10330 has a severity rating of 7.5 (high).
How can an attacker exploit CVE-2019-10330?
An attacker without commit access to the Git repo can exploit CVE-2019-10330 by changing Jenkinsfiles.
Is there a fix for CVE-2019-10330?
Yes, updating Jenkins Gitea Plugin to a version higher than 1.1.1 fixes CVE-2019-10330.
- collector/nvd-index
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-q98c-rqx7-7ghf
- alias/CVE-2019-10330
- collector/nvd-cve
- agent/weakness
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/description
- agent/event
- agent/first-publish-date
- agent/tags
- agent/trending
- vendor/gitea
- canonical/gitea gitea
- version/gitea gitea/1.1.1
- package-manager/maven