PT-2023-20287 · Jenkins · Jenkins Email Extension Plugin+1

Yaroslav Afenkin · Published 2023-02-15 · Updated 2025-03-19 · CVE-2023-25763

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Email Extension Plugin versions 2.93 and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because various fields included in bundled email templates are not properly escaped, allowing attackers who can control these fields to exploit the vulnerability.

Recommendations For Jenkins Email Extension Plugin versions 2.93 and earlier, update to a version later than 2.93 to resolve the issue. As a temporary workaround, consider restricting access to email templates to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-25763

GHSA-H97R-FCHM-M23X

Affected Products

Jenkins

Jenkins Email Extension Plugin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-25763 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25763 · Vendor Advisory
• https://jenkins.io/security/advisory/2023-02-15/#SECURITY-2931 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h97r-fchm-m23x · Vendor Advisory
• https://github.com/jenkinsci/email-ext-plugin · Note
• https://github.com/jenkinsci/email-ext-plugin/commit/ebfb97475ec6491f28b88a8b5acbb99ff36f4d7f · Note
• https://t.me/cvenotify/115398 · Telegram Post
• https://t.me/cibsecurity/58232 · Telegram Post
• http://openwall.com/lists/oss-security/2023/02/15/4 · Note
• https://t.me/cvenotify/44338 · Telegram Post