Reflected XSS vulnerability in Jenkins gitlab-hook Plugin

MEDIUM 6.1CVE-2020-2096 · GHSA-8696-836p-c8qp · Published 15/01/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
org.jenkins-ci.ruby-plugins:gitlab-hook Maven	`≤ 1.4.2`	No fix yet
gitlab hook jenkins	`≤ 1.4.2`	No fix yet

Description

Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.

NVD description

Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.