Lucene search

GoogleOSV:GHSA-H97R-FCHM-M23X

HistoryFeb 15, 2023 - 3:30 p.m.

Cross-site Scripting in Jenkins Email Extension Plugin

2023-02-1515:30:41

Google

osv.dev

cross-site scripting

jenkins

extension

plugin

vulnerability

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

32.2%

JSON

Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control affected fields.

CPENameOperatorVersion
org.jenkins-ci.plugins:email-exteq2.37.1
org.jenkins-ci.plugins:email-exteq2.54
org.jenkins-ci.plugins:email-exteq2.28
org.jenkins-ci.plugins:email-exteq2.69.1
org.jenkins-ci.plugins:email-exteq2.82
org.jenkins-ci.plugins:email-exteq2.13
org.jenkins-ci.plugins:email-exteq2.40
org.jenkins-ci.plugins:email-exteq2.79
org.jenkins-ci.plugins:email-exteq2.25
org.jenkins-ci.plugins:email-exteq2.40.2

Name	Operator	Version
org.jenkins-ci.plugins:email-ext	eq	2.37.1
org.jenkins-ci.plugins:email-ext	eq	2.54
org.jenkins-ci.plugins:email-ext	eq	2.28
org.jenkins-ci.plugins:email-ext	eq	2.69.1
org.jenkins-ci.plugins:email-ext	eq	2.82
org.jenkins-ci.plugins:email-ext	eq	2.13
org.jenkins-ci.plugins:email-ext	eq	2.40
org.jenkins-ci.plugins:email-ext	eq	2.79
org.jenkins-ci.plugins:email-ext	eq	2.25
org.jenkins-ci.plugins:email-ext	eq	2.40.2

Rows per page:

1-10 of 1061

References

www.openwall.com/lists/oss-security/2023/02/15/4

github.com/jenkinsci/email-ext-plugin

github.com/jenkinsci/email-ext-plugin/commit/ebfb97475ec6491f28b88a8b5acbb99ff36f4d7f

nvd.nist.gov/vuln/detail/CVE-2023-25763

www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2931