CVE-2017-2651: Information Disclosure in Jenkins-mailer-plugin
Summary
CVE-2017-2651: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins-mailer-plugin. Affects org.jenkins-ci.plugins:mailer versions < 1.20. Fixed in 1.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins-mailer-plugin is a plugin for the Jenkins automation server that allows users to send emails to a dynamically created list of users based on changelogs. It is commonly used to notify users about build results or other important information. The plugin is implemented as a Maven package with the package name 'org.jenkins-ci.plugins:mailer'.
Vulnerability Detail
The Jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure. When using the feature to send emails to a dynamically created list of users based on changelogs, the plugin may send emails to people who do not have a user account in Jenkins. In some rare cases, it may even send emails to people who were not involved in the project being built. This vulnerability is due to a mapping issue based on the local-part of email addresses. The impact of this vulnerability is the exposure of sensitive information to unauthorized actors.
How To Fix
Minimum fixed version
1.20
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of the Jenkins-mailer-plugin.
Conclusion
The Jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure issue that can expose sensitive information to unauthorized actors. To mitigate this vulnerability, it is recommended to upgrade to the latest version of the plugin. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:mailer →
FAQ
The Jenkins-mailer-plugin is a plugin for the Jenkins automation server that allows users to send emails to a dynamically created list of users based on changelogs.
The vulnerability allows for the exposure of sensitive information to unauthorized actors.
To fix this vulnerability, it is recommended to upgrade the Jenkins-mailer-plugin to version 1.20 or later.
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of the Jenkins-mailer-plugin.
More information about the Jenkins-mailer-plugin can be found on the official Jenkins website or the plugin's documentation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:mailer.
