PT-2018-7159 · Jenkins · Jenkins Mailer Plugin+1

Caleb Tennis · Published 2018-07-27 · Updated 2022-05-13 · CVE-2017-2651

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Mailer Plugin versions prior to 1.20

Description: The issue allows for information disclosure when using the feature to send emails to a dynamically created list of users based on the changelogs. This could result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in the project, due to some mapping based on the local-part of email addresses.

Recommendations: For Jenkins Mailer Plugin versions prior to 1.20, update to version 1.20 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-2651

GHSA-9V72-P5P3-9W65

Affected Products

Jenkins

Jenkins Mailer Plugin

References · 6

• https://jenkins.io/security/advisory/2017-03-20 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2651 · Security Note
• https://osv.dev/vulnerability/GHSA-9v72-p5p3-9w65 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2651 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2651 · Note
• http://securityfocus.com/bid/96984 · Note