Maven package
org.jenkins-ci.plugins/gitee
pkg:maven/org.jenkins-ci.plugins/gitee
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-57293 | Med | 4.3 | < 1292.v2559f2f3f2c0 | 1292.v2559f2f3f2c0 | Jun 24, 2026 | An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins. | |
| CVE-2026-57292 | Med | 5.4 | < 1292.v2559f2f3f2c0 | 1292.v2559f2f3f2c0 | Jun 24, 2026 | A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method. | |
| CVE-2026-57291 | Med | 5.4 | < 1292.v2559f2f3f2c0 | 1292.v2559f2f3f2c0 | Jun 24, 2026 | Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method. |
- affected < 1292.v2559f2f3f2c0fixed 1292.v2559f2f3f2c0
An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins.
- affected < 1292.v2559f2f3f2c0fixed 1292.v2559f2f3f2c0
A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
- affected < 1292.v2559f2f3f2c0fixed 1292.v2559f2f3f2c0
Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.