CVE Vulnerability

CVE-2023-25765

In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

9.9 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2939 Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/02/15/4 Mailing List Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:jenkins:email_extension:*:*:*:*:*:jenkins:*:*
Information

Published : 2023-02-15 02:15

Updated : 2023-02-23 04:47

NVD link : CVE-2023-25765

Mitre link : CVE-2023-25765

Products Affected
No products.
CWE
CWE-693