CVE-2022-20613: Cross-Site Request Forgery in Jenkins Mailer Plugin
Summary
CVE-2022-20613: Cross-Site Request Forgery in Jenkins Mailer Plugin. Affects org.jenkins-ci.plugins:mailer across 2 version ranges.
< 1.34.2
>= 391.ve4a38c1bcf4b, < 408.vd726a
Fixed in 1.34.2 or 408.vd726a, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Mailer Plugin is a component of the Jenkins automation server that allows users to configure email notifications for build results. It integrates with the Jenkins instance's DNS to resolve hostnames for email recipients. This plugin is widely used in software development and continuous integration workflows.
Vulnerability Detail
The Jenkins Mailer Plugin prior to version 408.vd726a_1130320 and 1.34.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The plugin does not perform a permission check in a method responsible for form validation. This allows attackers with Overall/Read access to exploit the DNS resolution functionality of the Jenkins instance and specify a malicious hostname. Additionally, the form validation method does not require POST requests, making it susceptible to CSRF attacks.
How To Fix
Latest published version: 534.v1b_36f5864073 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.34.21.34.2 -
>= 391.ve4a38c1bcf4b, < 408.vd726a408.vd726a
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions of the Mailer Plugin to ensure the security of the Jenkins instance.
Conclusion
The Jenkins Mailer Plugin prior to version 408.vd726a_1130320 and 1.34.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack. Upgrading to the fixed versions of the plugin is essential to prevent unauthorized DNS resolution and mitigate the CSRF vulnerability. It is recommended to apply the fix promptly to ensure the security of your Jenkins instance. For additional support and guidance, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:mailer →
FAQ
This vulnerability allows attackers with Overall/Read access to exploit the DNS resolution functionality of the Jenkins instance and specify a malicious hostname. It can potentially lead to unauthorized DNS resolution and CSRF attacks.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the recommended fix to prevent potential attacks.
No, upgrading to the fixed versions of the Mailer Plugin is the recommended solution to mitigate this vulnerability. There are no known workarounds.
For further support on vulnerability remediation and assistance with Jenkins security, you can reach out to info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:mailer.
