-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:gitlab-plugin | maven | <= 1.5.34 | 1.5.35 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unescaped user-provided fields in webhook-triggered build descriptions. The patch modifies the Jelly template to stop displaying it.shortDescription, replacing it with static text. The removed Jelly line '<j:out value="${it.shortDescription}"/>' directly references the getShortDescription() method from GitLabWebHookCause, which contained the unneutralized input. Since Jelly's escape-by-default wasn't sufficient (likely due to pre-HTML-encoded values from the cause object), this method represents the vulnerable data source in the runtime stack when rendering XSS payloads.