CVE-2018-1000417: CSRF vulnerability in Email Extension Template Plugin
Summary
CVE-2018-1000417: CSRF vulnerability in Email Extension Template Plugin. Affects org.jenkins-ci.plugins:email-ext versions < 1.1. Fixed in 1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Email Extension Template Plugin is a Jenkins plugin that allows users to create and manage email templates for sending notifications. It is commonly used in Jenkins instances to customize email notifications for various events. The plugin provides a user interface for creating and deleting templates.
Vulnerability Detail
A cross-site request forgery (CSRF) vulnerability exists in the Email Extension Template Plugin version 1.0 and earlier. The vulnerability is located in the ExtEmailTemplateManagement.java file. An attacker can exploit this vulnerability to create or remove templates without proper authorization. This can lead to unauthorized modification of email templates and potential abuse of the email notification system.
How To Fix
Latest published version: 2038.v7b_8817a_499d9 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the plugin as soon as possible.
Conclusion
In conclusion, the Email Extension Template Plugin version 1.0 and earlier is vulnerable to a CSRF vulnerability that allows unauthorized creation or removal of templates. Upgrading to version 1.1 or later is recommended to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:email-ext →
FAQ
A CSRF vulnerability allows an attacker to perform unauthorized actions on behalf of a victim user by tricking them into making a malicious request.
This vulnerability can be exploited to modify or delete email templates, potentially leading to unauthorized email notifications or abuse of the email notification system.
Yes, upgrading to version 1.1 or later of the Email Extension Template Plugin fixes this vulnerability.
No, there are no known workarounds for this vulnerability. Upgrading to the latest version of the plugin is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-4m38-gqh8-x266/GHSA-4m38-gqh8-x266.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:email-ext.
