org.jenkins-ci.plugins:gitlab-plugin

6 results · Feed

• Medium 4.3
  CVE-2025-24397

  Incorrect permission check in Jenkins GitLab Plugin allows enumerating credentials IDs

  An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credential IDs of GitLab API token and Secret text cre…

  Jenkins Project Jenkins GitLab Plugin org.jenkins-ci.plugins:gitlab-plugin Web / CMS Maven
  Jan 22, 2025
• Medium 5.3
  CVE-2022-43411

  Non-constant time webhook token comparison in Jenkins GitLab Plugin

  Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.

  Jenkins Project Jenkins GitLab Plugin org.jenkins-ci.plugins:gitlab-plugin Web / CMS Maven
  Oct 19, 2022
• High 8.0
  CVE-2022-34777 EPSS 74%

  Cross-site Scripting in Jenkins GitLab Plugin

  Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

  Jenkins Project Jenkins GitLab Plugin org.jenkins-ci.plugins:gitlab-plugin Web / CMS Maven
  Jun 30, 2022
• Medium 4.3
  CVE-2022-30955

  Missing permission check in Jenkins GitLab Plugin

  Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

  Jenkins Project Jenkins GitLab Plugin org.jenkins-ci.plugins:gitlab-plugin Web / CMS Maven
  May 17, 2022
• High 8.8
  CVE-2019-10301

  Jenkins GitLab Plugin missing permission checks

  A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified creden…

  Jenkins Project Jenkins GitLab Plugin org.jenkins-ci.plugins:gitlab-plugin Web / CMS Maven
  Apr 18, 2019
• High 8.0
  CVE-2019-10300

  Jenkins GitLab Plugin Cross-Site Request Forgery vulnerability

  A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obt…

  Jenkins Project Jenkins GitLab Plugin org.jenkins-ci.plugins:gitlab-plugin Web / CMS Maven
  Apr 18, 2019