CVE-2017-2654

Description

From CVE.org

jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score3.75.33.7
Attack VectorNetworkNetworkNetwork
Attack ComplexityHighLowHigh
Privileges RequiredNoneNoneNone
User InteractionNoneNoneNone
ScopeUnchangedUnchangedUnchanged
ConfidentialityLowLowLow
Integrity ImpactNoneNoneNone
Availability ImpactNoneNoneNone

Vector

Red Hat: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

cve.org: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Understanding the Weakness (CWE)

CWE-200

Confidentiality

Technical Impact: Read Application Data

Acknowledgements

Red Hat would like to thank the Jenkins project for reporting this issue. Upstream acknowledges Caleb Tennis (CloudBees) as the original reporter.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.