Caleb Tennis

Name of the Vulnerable Software and Affected Versions: Jenkins-email-ext versions prior to 2.57.1 Description: The issue allows the Email Extension Plugin to send emails to a dynamically created list of users based on changelogs, such as authors of SCM changes since the last successful build. This could result in emails being sent to people who have no user account in Jenkins, and in rare cases, even people who were not involved in the project being built, due to mapping based on the local-part of email addresses. Recommendations: For versions prior to 2.57.1, update to version 2.57.1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Jenkins Mailer Plugin versions prior to 1.20 Description: The issue allows for information disclosure when using the feature to send emails to a dynamically created list of users based on the changelogs. This could result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in the project, due to some mapping based on the local-part of email addresses. Recommendations: For Jenkins Mailer Plugin versions prior to 1.20, update to version 1.20 or later to resolve the issue.