GHSA-h97r-fchm-m23x

Cross-site Scripting in Jenkins Email Extension Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-25763

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:email-ext	< 2.94	2.94

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control affected fields.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-25763 advisory
https://github.com/jenkinsci/email-ext-plugin/commit/ebfb97475ec6491f28b88a8b5acbb99ff36f4d7f web
https://github.com/jenkinsci/email-ext-plugin package
https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2931 web
http://www.openwall.com/lists/oss-security/2023/02/15/4 web