-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability arises from two key failures: 1) In ForkPullRequestDiscoveryTrait.java, the TrustContributors.checkTrusted method lacked null-safety in collaborator list checks, potentially granting trust incorrectly. 2) GiteaSCMSource.java lacked the getTrustedRevision method entirely, failing to enforce branch trust validation. The commit diff shows these were the focal points of the patch: adding null-handling in checkTrusted and introducing getTrustedRevision to fetch collaborator data and validate PR origins. These functions directly relate to the CWE-693 (broken trust mechanism) and CWE-862 (missing authorization checks) descriptions in the advisory.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:gitea | maven | < 1.1.2 | 1.1.2 |