Jenkins Gitlab Plugin
Approved changes feed: RSS · Atom
cpe:2.3:a:jenkins_project:jenkins_gitlab_plugin:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Jenkins Project (860cd631-1316-551d-89a3-5aa9a0d4f462) |
|---|---|
| Product | Jenkins Gitlab Plugin (f8496953-5f46-531f-8391-509830ad9220) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-24397 |
vulnerable | 2026-06-08 07:12:48.556780 |
Details available
An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credential IDs of GitLab API token and Secret text credentials stored in Jenkins.
Published: 2025-01-22T17:02:51.699Z
Updated: 2025-01-23T16:11:07.171Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-43411 |
vulnerable | 2026-06-08 05:49:31.795955 |
Details available
Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.
Published: 2022-10-19T00:00:00.000Z
Updated: 2025-05-08T19:21:35.072Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-34777 |
vulnerable | 2026-06-08 05:46:03.428185 |
Details available
Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Published: 2022-06-30T17:45:54.000Z
Updated: 2024-08-03T09:22:10.421Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-30955 |
vulnerable | 2026-06-08 05:43:39.877292 |
Details available
Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Published: 2022-05-17T14:06:23.000Z
Updated: 2024-08-03T07:03:39.911Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10301 |
vulnerable | 2026-06-08 05:12:23.130079 |
Details available
A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Published: 2019-04-18T16:54:18.000Z
Updated: 2024-08-04T22:17:19.852Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10300 |
vulnerable | 2026-06-08 05:12:23.128992 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.