CVE-2017-2654: Infoleak
jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2654?
CVE-2017-2654 is classified as a moderate-severity vulnerability due to potential information exposure.
How do I fix CVE-2017-2654?
To fix CVE-2017-2654, upgrade the Jenkins Email Extension plugin to version 2.57.1 or later.
What types of information are exposed in CVE-2017-2654?
CVE-2017-2654 may expose user information by sending emails to a dynamically created list that includes authors of SCM changes.
Which versions are affected by CVE-2017-2654?
CVE-2017-2654 affects all versions of the Jenkins Email Extension plugin prior to 2.57.1.
Is CVE-2017-2654 still a risk if I have updated my Jenkins installation?
If you have updated to the Jenkins Email Extension plugin version 2.57.1 or later, CVE-2017-2654 is no longer a risk.