GHSA-p2fr-mq9m-6w6p

Cross-site Scripting in Jenkins Email Extension Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-25764

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:email-ext	< 2.94	2.94

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or change custom email templates.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-25764 advisory
https://github.com/jenkinsci/email-ext-plugin/commit/7b2bd251aa0193d009d85b713362d965dab262d0 web
https://github.com/jenkinsci/email-ext-plugin package
https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2934 web
http://www.openwall.com/lists/oss-security/2023/02/15/4 web