Non notée
CVE-2022-34777 Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of…
Description
Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Jenkins GitLab Plugin 1.5 | premières → 1.5.34 | Pas de correctif indiqué |
Autres CVE de Jenkins GitLab Plugin
Les 8 CVE de Jenkins GitLab Plugin →
CVE-2026-92133
Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API…
5.4
Moyenne
CVE-2026-84664
Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler…
5.4
Moyenne
CVE-2025-24397
An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure…
4.3
Moyenne
CVE-2022-43411
Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided…
5.3
Moyenne