CVE-2017-2651: Infoleak
First published: Fri Jul 27 2018(Updated: )
jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Mailer Jenkins | <1.20 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-2651?
The severity level of CVE-2017-2651 is medium with a value of 3.7.
How can CVE-2017-2651 be exploited?
CVE-2017-2651 can be exploited by using the feature to send emails to a dynamically created list of users based on the changelogs.
What is the affected software version for CVE-2017-2651?
The affected software version for CVE-2017-2651 is jenkins-mailer-plugin before version 1.20.
How can I fix CVE-2017-2651?
To fix CVE-2017-2651, upgrade to version 1.20 or later of the jenkins-mailer-plugin.
Where can I find more information about CVE-2017-2651?
More information about CVE-2017-2651 can be found at the following references: [link1], [link2], [link3].
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/tags
- agent/description
- agent/softwarecombine
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/jenkins
- canonical/jenkins mailer jenkins