Cross-site Scripting in Jenkins GitLab Plugin

MEDIUM 5.4CVE-2022-34777 · GHSA-f655-xhvm-cwp4 · Published 30/06/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:gitlab-plugin Maven	`< 1.5.35`	`1.5.35`
gitlab jenkins	`≤ 1.5.34`	No fix yet

Description

Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. GitLab Plugin 1.5.35 does not show user-provided fields in the build cause of webhook-triggered builds.

GitLab Plugin 1.5.35 does not show user-provided fields in the build cause of webhook-triggered builds.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-34777 · ADVISORY
jenkinsci/gitlab-plugin commit 24e9a99 · WEB
jenkinsci/gitlab-plugin · PACKAGE
jenkins.io/security/advisory/2022-06-30 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free