Information Exposure in Jenkins Email Extension Plugin by CloudBees
CVE-2017-2654

3.7LOW

Key Information:

Vendor

[unknown]

Status
Jenkins-email-ext
Vendor
CVE Published:
6 August 2018

What is CVE-2017-2654?

The Jenkins Email Extension Plugin before version 2.57.1 suffers from an information exposure vulnerability, which can inadvertently disclose sensitive email notifications. The plugin's capability to dynamically generate recipient lists based on SCM changelogs may result in emails being dispatched to users without proper Jenkins accounts. In certain circumstances, this can extend to individuals entirely unassociated with the project, due to mishandling local-part mappings of email addresses. This flaw underscores the necessity for robust user validation and control measures in software communication functionalities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

jenkins-email-ext 2.57.1

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2654
x_refsource_CONFIRM
https://jenkins.io/security/advisory/2017-03-20/
x_refsource_CONFIRM

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.