Not rated
CVE-2022-34777 Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of…
Description
Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins GitLab Plugin 1.5 | earliest → 1.5.34 | No fix stated |
Other CVEs of Jenkins GitLab Plugin
The 8 CVEs of Jenkins GitLab Plugin →
CVE-2026-92133
Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API…
5.4
Medium
CVE-2026-84664
Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler…
5.4
Medium
CVE-2025-24397
An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure…
4.3
Medium
CVE-2022-43411
Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided…
5.3
Medium