PT-2019-8728 · Jenkins · Jenkins Email Extension Template Plugin+1

Daniel Beck · Published 2019-01-09 · Updated 2022-05-14 · CVE-2018-1000417

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Email Extension Template Plugin version 1.0 and earlier

Description A cross-site request forgery issue exists in the ExtEmailTemplateManagement.java file, allowing unauthorized creation or removal of templates.

Recommendations For Jenkins Email Extension Template Plugin version 1.0 and earlier, consider disabling the ExtEmailTemplateManagement.java functionality until a patch is available to prevent unauthorized template creation or removal.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-1000417

GHSA-4M38-GQH8-X266

Affected Products

Jenkins

Jenkins Email Extension Template Plugin

References · 6

• https://osv.dev/vulnerability/CVE-2018-1000417 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4m38-gqh8-x266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000417 · Security Note
• https://github.com/jenkinsci/emailext-template-plugin/commit/74653060cef7507425642841e0f2e58d10aa389f · Note
• http://securityfocus.com/bid/106532 · Note
• https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1125 · Note