Jenkins project Vulnerabilities and Affected Products
Vulnerabilities associated with Jenkins Email Extension Plugin.
Products
Clear product- Jenkins124 vulnerabilities
- Jenkins Script Security Plugin29 vulnerabilities
- Jenkins Active Directory Plugin11 vulnerabilities
- Jenkins Pipeline: Groovy Plugin11 vulnerabilities
- Jenkins Email Extension Plugin9 vulnerabilities
- Jenkins Build Failure Analyzer Plugin8 vulnerabilities
- Jenkins NS-ND Integration Performance Publisher Plugin8 vulnerabilities
- Jenkins OpenId Connect Authentication Plugin8 vulnerabilities
- Jenkins Pipeline: Shared Groovy Libraries Plugin8 vulnerabilities
- Jenkins Amazon EC2 Plugin7 vulnerabilities
- Jenkins Configuration as Code Plugin7 vulnerabilities
- Jenkins Git Plugin7 vulnerabilities
- Jenkins Job Configuration History Plugin7 vulnerabilities
- Jenkins OpenShift Deployer Plugin7 vulnerabilities
- Jenkins Rundeck Plugin7 vulnerabilities
- Jenkins SAML Single Sign On(SSO) Plugin7 vulnerabilities
- Jenkins Artifactory Plugin6 vulnerabilities
- Jenkins Azure VM Agents Plugin6 vulnerabilities
- Jenkins Config File Provider Plugin6 vulnerabilities
- Jenkins Credentials Binding Plugin6 vulnerabilities
- Jenkins Deployment Dashboard Plugin6 vulnerabilities
- Jenkins ElectricFlow Plugin6 vulnerabilities
- Jenkins Git Parameter Plugin6 vulnerabilities
- Jenkins GitLab Authentication Plugin6 vulnerabilities
- Jenkins GitLab Plugin6 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-48920HIGH | Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystemJenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem. CWE-73May 27, 2026 | CVSS8.8v3.1 | EPSS0.288% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-32980MEDIUM | Jenkins Email Extension Plugin Cross-Site Request Forgery vulnerabilityA cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified job. CWE-352May 16, 2023 | CVSS4.3v3.1 | EPSS0.368% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-32979MEDIUM | Jenkins Email Extension Plugin missing permission checkJenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system. CWE-732May 16, 2023 | CVSS4.3v3.1 | EPSS0.503% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-25765CRITICAL | Sandbox escape in Jenkins Email Extension PluginIn Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. CWE-693Feb 15, 2023 | CVSS9.9v3.1 | EPSS1.1% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-25764MEDIUM | Cross-site Scripting in Jenkins Email Extension PluginJenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or change custom email templates. CWE-79Feb 15, 2023 | CVSS5.4v3.1 | EPSS0.602% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-25763MEDIUM | Cross-site Scripting in Jenkins Email Extension PluginJenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control affected fields. CWE-79Feb 15, 2023 | CVSS5.4v3.1 | EPSS0.602% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-2253MEDIUM | Missing hostname validation in Email Extension PluginJenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server. CWE-295Sep 16, 2020 | CVSS4.8v3.1 | EPSS0.691% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-2232HIGH | Jenkins Email Extension Plugin SMTP password transmitted and displayed in plain textJenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potentially resulting in its exposure. CWE-319Aug 12, 2020 | CVSS7.5v3.1 | EPSS0.755% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-1003032CRITICAL | Script security sandbox bypass in Jenkins Email Extension PluginA sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JV… CWE-693Mar 8, 2019 | CVSS9.9v3.1 | EPSS2.44% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |