Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2022-20614

jenkins-2-plugins/mailer: does not perform a permission check in a method implementing form validation

A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Jenkins Oracle
Products
Mailer Communications Cloud Native Core Automated Test Suite
CVE-2022-20613

jenkins-2-plugins/mailer: form validation method does not require POST requests which could lead to CSRF

A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins Oracle
Products
Mailer Communications Cloud Native Core Automated Test Suite
CVE-2020-2252

jenkins-2-plugins/mailer: Missing hostname validation in Mailer Plugin could result in MITM

Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins Redhat
Products
Mailer Openshift
CVE-2018-8718

jenkins-plugin-mailer: Missing permissions check in Mailer.java:doSendTestMail() allows unauthorised users to send mail

Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.

CVSS 3.0 · 8.0 High EPSS 6.5% KEV · Not listed
Vendors
Jenkins
Products
Mailer
CVE-2017-2651

jenkins-mailer-plugin: Emails were sent to addresses not associated with actual users of Jenkins by Mailer Plugin

jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.

CVSS 3.0 · 3.7 Low EPSS 1.6% KEV · Not listed
Vendors
Jenkins
Products
Mailer