CVE-2017-2651

low-risk
Published 2018-07-27

jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.

Do I need to act?

-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.7/10 Low
NETWORK / HIGH complexity

Affected Products (1)

Mailer

Affected Vendors

Jenkins

References (6)

Third Party Advisory http://www.securityfocus.com/bid/96984
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2651
Vendor Advisory https://jenkins.io/security/advisory/2017-03-20/
Third Party Advisory http://www.securityfocus.com/bid/96984
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2651
Vendor Advisory https://jenkins.io/security/advisory/2017-03-20/
18
/ 100
low-risk
Severity 13/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal