CVE-2023-25763: Cross-site Scripting in Jenkins Email Extension Plugin
Summary
CVE-2023-25763: Cross-site Scripting in Jenkins Email Extension Plugin. Affects org.jenkins-ci.plugins:email-ext versions < 2.94. Fixed in 2.94. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Email Extension Plugin is a Maven-based package that provides email notification functionality for Jenkins, an open-source automation server. It allows users to configure email notifications for various events in their Jenkins pipelines. The plugin includes bundled email templates that can be customized to send notifications with dynamic content. However, versions 2.93 and earlier of the plugin do not properly escape certain fields in these templates, making them vulnerable to stored cross-site scripting (XSS) attacks. This vulnerability can be exploited by attackers who can control the affected fields, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The Jenkins Email Extension Plugin versions 2.93 and earlier are susceptible to a stored cross-site scripting (XSS) vulnerability. This vulnerability arises due to the lack of proper escaping of various fields in the bundled email templates. Attackers with control over these fields can inject malicious scripts that will be executed in the context of the victim's browser when the email is viewed. This can lead to the compromise of user accounts, session hijacking, or the theft of sensitive information. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Latest published version: 2038.v7b_8817a_499d9 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.94
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually escape the affected fields in the email templates to prevent the execution of malicious scripts. This can be achieved by properly encoding special characters and HTML entities. However, this workaround is not recommended as it requires manual intervention and may introduce human error. It is strongly advised to apply the official fix by upgrading to a non-vulnerable version of the plugin.
Conclusion
The Jenkins Email Extension Plugin versions 2.93 and earlier are vulnerable to a stored cross-site scripting (XSS) attack. To mitigate this issue, it is recommended to upgrade to version 2.94 or later of the plugin. Users should promptly update their installations to ensure the security of their Jenkins environment. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:email-ext →
FAQ
The vulnerability allows attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to unauthorized access, data theft, or other malicious activities.
Users of Jenkins Email Extension Plugin versions 2.93 and earlier are affected by this vulnerability.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is advisable to apply the recommended fix as soon as possible to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely by attackers who can control the affected fields in the email templates.
Yes, this vulnerability has been assigned the CVE identifier CVE-2023-25763.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:email-ext.
