-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from how Personal Access Tokens were handled in repository URL construction. The removed code block in GiteaSCMBuilder.java explicitly created URIs with the token's plaintext value via ((PersonalAccessToken) credentials).getToken().getPlainText(), which would appear in build logs. The patched version removes this insecure credential handling path. The credential interface changes (to StandardUsernamePasswordCredentials) and new masking methods in PersonalAccessTokenImpl.java indicate the fix involved proper credential masking integration that was previously missing.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:gitea | maven | < 1.4.5 | 1.4.5 |
Ongoing coverage of React2Shell