CVE-2022-34777: Cross-site Scripting in Jenkins GitLab Plugin
Summary
CVE-2022-34777: Cross-site Scripting in Jenkins GitLab Plugin. Affects org.jenkins-ci.plugins:gitlab-plugin versions < 1.5.35. Fixed in 1.5.35. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins GitLab Plugin is a Maven package that integrates Jenkins with GitLab, allowing users to trigger builds and perform other actions in Jenkins based on events in GitLab. It provides functionality for webhook-triggered builds and allows users to configure various fields for these builds.
Vulnerability Detail
The Jenkins GitLab Plugin versions 1.5.34 and earlier are vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability occurs because the plugin does not properly escape multiple fields inserted into the description of webhook-triggered builds. Attackers with Item/Configure permission can exploit this vulnerability to inject malicious scripts into the build description, which will be executed when viewed by other users. The GitLab Plugin version 1.5.35 addresses this issue by not showing user-provided fields in the build cause of webhook-triggered builds.
How To Fix
Latest published version: 1.2158.v49db_f64b_fc28 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.35
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 1.5.35 is not immediately possible, users can mitigate the risk by restricting Item/Configure permission to trusted individuals only. This will limit the potential attackers who can exploit the vulnerability. Additionally, users should exercise caution when viewing the build description and avoid executing any scripts embedded in it.
Conclusion
The Jenkins GitLab Plugin versions 1.5.34 and earlier are vulnerable to a stored cross-site scripting (XSS) attack. It is crucial to upgrade to version 1.5.35 or later to mitigate this vulnerability. Restricting Item/Configure permission and exercising caution when viewing the build description can provide temporary mitigation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:gitlab-plugin →
FAQ
This vulnerability allows attackers with Item/Configure permission to inject malicious scripts into the build description of webhook-triggered builds. When viewed by other users, these scripts will be executed, potentially leading to unauthorized actions, data theft, or further compromise of the Jenkins environment.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins GitLab Plugin version is affected by this vulnerability. Simply enter your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are detected.
Yes, if upgrading to version 1.5.35 is not immediately possible, you can mitigate the risk by restricting Item/Configure permission to trusted individuals only. Additionally, exercise caution when viewing the build description and avoid executing any scripts embedded in it.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fixes to prevent potential exploitation.
You can find more information about this vulnerability, including the CVE identifier (CVE-2022-34777), in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-f655-xhvm-cwp4/GHSA-f655-xhvm-cwp4.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:gitlab-plugin.
