CVE-2019-10330

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Gitea Plugin	1.1.1 and earlier

References

http://www.openwall.com/lists/oss-security/2019/05/31/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/108540Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1046Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/05/31/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/108540Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1046Vendor Advisory

Timeline

Published: May 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-103314.3A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attack CVE-2019-103324.3A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/Rea CVE-2019-103334.3Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access CVE-2019-103346.5Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartU CVE-2019-103355.4A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jen CVE-2019-103366.1A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output CVE-2019-103377.5An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content o CVE-2019-103388.8A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient a CVE-2019-103398.8A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users wit CVE-2019-10347.8A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who CVE-2019-103408.8A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed u CVE-2019-103416.5A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overal