CVE-2018-1000176: Infoleak
An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/ExtendedEmailPublisher/global.groovy and ExtendedEmailPublisherDescriptor.java that allows attackers with control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured SMTP password.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-1000176.
What is the severity of CVE-2018-1000176?
The severity of CVE-2018-1000176 is medium with a severity value of 6.5.
What is the affected software for CVE-2018-1000176?
The affected software for CVE-2018-1000176 is Jenkins Email Extension Plugin version 2.61 and older.
How can an attacker exploit CVE-2018-1000176?
An attacker with control of a Jenkins administrator's web interface can exploit CVE-2018-1000176 to expose sensitive information.
Is there a fix available for CVE-2018-1000176?
Yes, a fix for CVE-2018-1000176 is available. It is recommended to update to a version of Jenkins Email Extension Plugin that is newer than 2.61.