PT-2023-20287 · Jenkins · Jenkins Email Extension Plugin+1

Yaroslav Afenkin · Publicado 2023-02-15 · Atualizado 2025-03-19 · CVE-2023-25763

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Email Extension Plugin versions 2.93 and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because various fields included in bundled email templates are not properly escaped, allowing attackers who can control these fields to exploit the vulnerability.

Recommendations For Jenkins Email Extension Plugin versions 2.93 and earlier, update to a version later than 2.93 to resolve the issue. As a temporary workaround, consider restricting access to email templates to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-25763

GHSA-H97R-FCHM-M23X

Produtos afetados

Jenkins

Jenkins Email Extension Plugin

Referências · 10

• https://github.com/jenkinsci/email-ext-plugin · Nota
• https://github.com/jenkinsci/email-ext-plugin/commit/ebfb97475ec6491f28b88a8b5acbb99ff36f4d7f · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25763 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25763 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2023-02-15/#SECURITY-2931 · Aviso do Fabricante
• https://t.me/cvenotify/115398 · Publicação no Telegram
• https://t.me/cibsecurity/58232 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/02/15/4 · Nota
• https://osv.dev/vulnerability/GHSA-h97r-fchm-m23x · Aviso do Fabricante
• https://t.me/cvenotify/44338 · Publicação no Telegram