4.3
Medium
CVE-2025-24397 An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure…
Description
An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credential IDs of GitLab API token and Secret text credentials stored in Jenkins.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins GitLab Plugin 1.9 | earliest → 1.9.6 | No fix stated |
References
- Jenkins Security Advisory 2025-01-22 www.jenkins.io
Timeline
- Published
- Last modified
Other CVEs of Jenkins GitLab Plugin
The 8 CVEs of Jenkins GitLab Plugin →
CVE-2026-92133
Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API…
5.4
Medium
CVE-2026-84664
Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler…
5.4
Medium
CVE-2022-43411
Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided…
5.3
Medium
CVE-2022-34777
Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of…
Not rated