TI-2022-15584 Aliases CVE-2022-34777 GHSA-f655-xhvm-cwp4

Cross-site scripting in Jenkins GitLab Plugin

MEDIUM 63CWE-79Published 2022-06-30 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Why it matters now

EPSS 0.73586 99th percentileScored 2026-11-07

Fix Fixed org.jenkins-ci.plugins:gitlab-plugin (Maven): 1.5.35

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins GitLab Plugin	up to 1.5.34	—	No fix listed	CNA
—	org.jenkins-ci.plugins:gitlab-plugin (Maven)	before 1.5.35	1.5.35	Patch available	GHSA-f655-xhvm-cwp4

Jenkins GitLab Plugin VendorJenkins Affected up to 1.5.34 Fixed in — No fix listed CNA
org.jenkins-ci.plugins:gitlab-plugin (Maven) Vendor— Affected before 1.5.35 Fixed in 1.5.35 Patch available GHSA-f655-xhvm-cwp4

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:gitlab::::::jenkins::*	up to 1.5.34	Vulnerable	Jenkins

cpe:2.3:a:jenkins:gitlab:*:*:*:*:*:jenkins:*:* Versions up to 1.5.34 Vulnerable ·Jenkins

Remediation

Fix · GHSA-f655-xhvm-cwp4 org.jenkins-ci.plugins:gitlab-plugin (Maven) Fixed in 1.5.35 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-34777
2026-10-03 Alias added: GHSA-f655-xhvm-cwp4

References

Advisory 2

Other 2

TI-2019-07610 Missing authorization in Jenkins GitLab Plugin CVSS 3.1HIGH 8.8
TI-2019-07609 Cross-site request forgery in Jenkins GitLab Plugin CVSS 3.0HIGH 8.0
TI-2022-21206 Observable discrepancy in Jenkins GitLab Plugin CVSS 3.1MEDIUM 5.3
TI-2022-13011 Missing authorization in Jenkins GitLab Plugin CVSS 3.1MEDIUM 6.5
TI-2025-18134 Incorrect authorization in Jenkins GitLab Plugin CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences