GHSA-gwxm-wqpq-w539

Jenkins Email Extension Plugin showed plain text SMTP password in configuration form field

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000176

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:email-ext	< 2.62	2.62

Details

As written in the advisory (Markdown source, shown as plain text).

An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/ExtendedEmailPublisher/global.groovy and ExtendedEmailPublisherDescriptor.java that allows attackers with control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured SMTP password.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000176 advisory
https://jenkins.io/security/advisory/2018-04-16 web