CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2023-25765

CVSS 9.9v3.1pub. 2023-02-15upd. 2025-03-19

In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Jenkins Email Extension

    APP
    Jenkins
    < 2.93.1
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
RCECI/CD
CWE
References

Related vulnerabilities

CVE-2019-1003032CRITICAL9.9ten sam produkt

A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/...

CVE-2026-48920HIGH8.8ten sam produkt

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email cont...

CVE-2020-2232HIGH7.5ten sam produkt

Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of...

CVE-2023-32979MEDIUM4.3ten sam produkt

Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, a...

CVE-2023-32980MEDIUM4.3ten sam produkt

A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make a...