PT-2018-7159 · Jenkins · Jenkins Mailer Plugin+1

Caleb Tennis · Publicado 2018-07-27 · Atualizado 2022-05-13 · CVE-2017-2651

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Mailer Plugin versions prior to 1.20

Description: The issue allows for information disclosure when using the feature to send emails to a dynamically created list of users based on the changelogs. This could result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in the project, due to some mapping based on the local-part of email addresses.

Recommendations: For Jenkins Mailer Plugin versions prior to 1.20, update to version 1.20 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-2651

GHSA-9V72-P5P3-9W65

Produtos afetados

Jenkins

Jenkins Mailer Plugin

Referências · 6

• https://jenkins.io/security/advisory/2017-03-20 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2651 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-9v72-p5p3-9w65 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2651 · Nota
• https://osv.dev/vulnerability/CVE-2017-2651 · Aviso do Fabricante
• http://securityfocus.com/bid/96984 · Nota