PT-2019-11730 · Jenkins · Jenkins Git Plugin
CVE-2019-10330
·
Publicado
2019-05-31
·
Atualizado
2023-10-25
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins Gitea Plugin versions 1.1.1 and earlier
Description
The issue allows attackers without commit access to the Git repository to change Jenkinsfiles, even if Jenkins is configured to consider them untrusted. This is due to the lack of implementation of trusted revisions in the affected plugin versions.
Recommendations
For Jenkins Gitea Plugin versions 1.1.1 and earlier, update to version 1.1.2 or later to resolve the issue.
Correção
Missing Authorization
Protection Mechanism Failure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Jenkins Git Plugin