CVE-2017-2654
mediumPriorität · verfolgen · 21EPSS 0.011 · 66. PerzentilEUUSEPSS · bewertet 2026-10-27
jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 3.7–5.3
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (3)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-c8qr-vfjf-62q3Emails were sent to addresses not associated with actual users of Jenkins by Email Extension Plugin2022-05-13ghsa · osvUS
jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (6)
Externe Belege — Patches, Meldungen, Analysen.
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2654cnnvd
- https://jenkins.io/security/advisory/2017-03-20/cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2654enisa_euvd
- https://jenkins.io/security/advisory/2017-03-20/enisa_euvd
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2654Issue TrackingThird Party Advisorynvd
- https://jenkins.io/security/advisory/2017-03-20/Vendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan