jenkins gitlab hook vulnerabilities

Latest jenkins gitlab hook CVEs

Newest publication first

1. CVE-2020-2096 Reflected XSS vulnerability in Jenkins gitlab-hook Plugin

   Published 2020-01-15

   Medium·CVSS 6.1 EPSS 93.2% Public exploit

   Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.

2. CVE-2018-1000196 Jenkins Gitlab Hook Plugin stores and displays GitLab API token in plain text

   Published 2018-06-05

   Medium·CVSS 6.5 EPSS 1.2%

   A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_notifier/global.erb that allows attackers with local Jenkins master file system access or control of a Jenkins administrator's web browser (e...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.