CVE-2017-2651 — Sensitive Information Exposure in Jenkins Mailer

CWE-200 — Sensitive Information Exposure9 documents7 sources
Severity
3.7LOWNVD
EPSS
0.0%
top 90.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins MailerJenkins Jenkins-mailer-plugin
Timeline
PublishedJul 27
Latest updateMay 13

Description

jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 2.2 | Impact: 1.4

Affected Packages2 packages

▶NVDjenkins/mailer< 1.20

🔴Vulnerability Details

3
GHSA
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins-mailer-plugin↗2022-05-13
▶
OSV
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins-mailer-plugin↗2022-05-13
▶
CVEList
CVE-2017-2651: jenkins-mailer-plugin before version 1↗2018-07-27
▶

📋Vendor Advisories

2
Jenkins
Jenkins Security Advisory 2017-03-20↗2017-03-20
▶
Red Hat
jenkins-mailer-plugin: Emails were sent to addresses not associated with actual users of Jenkins by Mailer Plugin↗2017-03-20
▶

💬Community

3
Bugzilla
CVE-2017-7593 libtiff: tif_rawdata not properly initialized in tif_read.c↗2017-04-11
▶
Bugzilla
CVE-2017-2651 jenkins-mailer-plugin: Emails were sent to addresses not associated with actual users of Jenkins by Mailer Plugin [fedora-all]↗2017-03-21
▶
Bugzilla
CVE-2017-2651 jenkins-mailer-plugin: Emails were sent to addresses not associated with actual users of Jenkins by Mailer Plugin↗2017-03-21
▶
CVE-2017-2651 — Sensitive Information Exposure | cvebase