Information Exposure in Jenkins Email Extension Plugin by CloudBees

CVE-2017-2654

What is CVE-2017-2654?

The Jenkins Email Extension Plugin before version 2.57.1 suffers from an information exposure vulnerability, which can inadvertently disclose sensitive email notifications. The plugin's capability to dynamically generate recipient lists based on SCM changelogs may result in emails being dispatched to users without proper Jenkins accounts. In certain circumstances, this can extend to individuals entirely unassociated with the project, due to mishandling local-part mappings of email addresses. This flaw underscores the necessity for robust user validation and control measures in software communication functionalities.

References