Jenkins GitLab Hook vulnerabilities

2 CVEs affecting Jenkins GitLab Hook, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-2096, published 2020-01-15.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-2096, published 2020-01-15. Medium severity, CVSS 6.1. EPSS: 92.8% chance of exploitation in the next 30 days. Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.
• CVE-2018-1000196, published 2018-06-05. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_notifier/global.erb that allows attackers with local Jenkins…