CVE-2017-2654 Emails were sent to addresses not associated with actual users of Jenkins by Email Extension Plugin
The Jenkins Email Extension plugin may send build notifications to unauthorized external users due to flawed email address mapping.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-2654?
CVE-2017-2654 is a low-severity vulnerability in [UNKNOWN] jenkins-email-ext, published on 6 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.
Weakness: CWE-200
Which versions are affected by CVE-2017-2654?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:email-ext. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:email-ext Maven | All versions | 2.57.1 |
org.jenkins-ci.plugins:email-ext Maven | All versions | 2.57.1 |
Products include Jenkins Email Extension.
How do I fix CVE-2017-2654?
Upgrade org.jenkins-ci.plugins:email-ext to 2.57.1 or later.
Is CVE-2017-2654 being exploited?
There is no known exploitation of CVE-2017-2654 in the wild and no public exploit code.
Other vulnerabilities in [UNKNOWN] jenkins-email-ext
- CVE-2023-25765 Sandbox escape in Jenkins Email Extension Plugin
- CVE-2019-1003032 Script security sandbox bypass in Jenkins Email Extension Plugin
- CVE-2026-48920 Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem
- CVE-2020-2232 Jenkins Email Extension Plugin SMTP password transmitted and displayed in plain text
- CVE-2018-1000176 Jenkins Email Extension Plugin showed plain text SMTP password in configuration form field
Sources
Also known as GHSA-c8qr-vfjf-62q3.