CVE-2022-34777: 
Java vulnerability analysis and mitigation

GitLab Plugin 1.5.34 and earlier contains a stored cross-site scripting (XSS) vulnerability (CVE-2022-34777) that affects multiple user-provided values shown in the build cause of webhook-triggered builds. The vulnerability was discovered and disclosed on June 30, 2022, and affects the Jenkins GitLab Plugin. The issue has been assigned a High severity rating (Jenkins Advisory).

The vulnerability exists because the plugin does not properly escape multiple user-provided values that are displayed as part of the build cause of webhook-triggered builds. This creates a stored cross-site scripting vulnerability that can be exploited by attackers who have Item/Configure permission in Jenkins (Jenkins Advisory).

The vulnerability allows attackers with Item/Configure permission to execute arbitrary web scripts or HTML in the context of other users viewing the build cause information of webhook-triggered builds. This could potentially lead to session hijacking, credential theft, or other malicious actions performed in the context of the victim's browser (Jenkins Advisory).

The vulnerability has been fixed in GitLab Plugin version 1.5.35, which removes the display of user-provided fields in the build cause of webhook-triggered builds. Users should upgrade to this version or later to mitigate the vulnerability (Jenkins Advisory).