CVE-2022-30955: Missing permission check in Jenkins GitLab Plugin
Summary
CVE-2022-30955: Missing permission check in Jenkins GitLab Plugin. Affects org.jenkins-ci.plugins:gitlab-plugin versions < 1.5.32. Fixed in 1.5.32. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins GitLab Plugin is a plugin for the Jenkins automation server that allows integration with GitLab, a web-based Git repository manager. It provides functionality for managing GitLab projects, triggering builds, and reporting build status back to GitLab. The plugin is widely used by developers and organizations to streamline their CI/CD workflows.
Vulnerability Detail
The Jenkins GitLab Plugin version 1.5.31 and earlier contains a vulnerability that allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This vulnerability arises from a missing permission check in an HTTP endpoint. An attacker with the appropriate permissions can exploit this vulnerability to gather sensitive information about the credentials stored in Jenkins. The issue has been addressed in GitLab Plugin version 1.5.32, which now requires the appropriate permissions for credential enumeration.
How To Fix
Latest published version: 1.2158.v49db_f64b_fc28 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.32
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version of the GitLab Plugin to mitigate the risk.
Conclusion
The Jenkins GitLab Plugin version 1.5.31 and earlier is vulnerable to an enumeration of credentials IDs, allowing attackers with Overall/Read permission to gather sensitive information. It is crucial to update to GitLab Plugin version 1.5.32 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:gitlab-plugin →
FAQ
This vulnerability allows attackers with Overall/Read permission to gather sensitive information about credentials stored in Jenkins. This information can be used for further attacks or unauthorized access to systems.
Users of Jenkins GitLab Plugin versions 1.5.31 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
Yes, the vulnerability has been fixed in GitLab Plugin version 1.5.32.
To update the GitLab Plugin, follow the standard update process for Jenkins plugins. Go to the Jenkins dashboard, navigate to the Manage Jenkins section, select the Manage Plugins option, and search for the GitLab Plugin. Click on the checkbox next to the plugin and click the 'Download now and install after restart' button.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:gitlab-plugin.
