CVE-2022-34777

Deeper analysis

The vulnerability is a stored cross-site scripting flaw in the Jenkins GitLab Plugin versions 1.5.34 and earlier. It stems from insufficient escaping of multiple fields that are inserted into the description of builds triggered by webhooks, allowing malicious content to persist and execute in users' browsers. The issue is tracked under CWE-79 and carries a CVSS 3.1 score of 5.4.

Attackers who possess Item/Configure permission on a Jenkins job can exploit the flaw by configuring a GitLab webhook integration that supplies unescaped payloads. When a subsequent webhook triggers a build, the injected script executes in the context of other users viewing the build description, enabling theft of credentials or session tokens within the Jenkins instance.

The official Jenkins security advisory published on 2022-06-30 recommends upgrading the GitLab Plugin to a fixed release that properly escapes the affected fields. Administrators are advised to apply the update promptly and review existing job configurations for potential stored payloads.

The EPSS score for this CVE rose from a low baseline to a peak of 0.3046 on 2025-12-11 before receding to the current value of 0.1493, indicating a notable increase in observed exploitation interest well after initial disclosure.