CVE-2017-2651
mediumPriorität · verfolgen · 16EPSS 0.016 · 76. PerzentilEUUSEPSS · bewertet 2026-10-27
jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 3.4–4.3
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (3)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-9v72-p5p3-9w65Exposure of Sensitive Information to an Unauthorized Actor in Jenkins-mailer-plugin2022-05-13ghsa · osvUS
jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (9)
Externe Belege — Patches, Meldungen, Analysen.
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2651cnnvd
- https://jenkins.io/security/advisory/2017-03-20/cnnvd
- https://www.securityfocus.com/bid/96984cnnvd
- http://www.securityfocus.com/bid/96984enisa_euvd
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2651enisa_euvd
- https://jenkins.io/security/advisory/2017-03-20/enisa_euvd
- http://www.securityfocus.com/bid/96984Third Party AdvisoryVDB Entrynvd
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2651Issue TrackingThird Party Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan