CVE-2020-2232
First published: Wed Aug 12 2020(Updated: )
Email Extension Plugin stores an SMTP password in its global configuration file `hudson.plugins.emailext.ExtendedEmailPublisher.xml` on the Jenkins controller as part of its configuration. While this password is stored encrypted on disk, it is transmitted and displayed in plain text as part of the configuration form by Email Extension Plugin 2.72 and 2.73. This can result in exposure of the password. Email Extension Plugin 2.74 transmits the SMTP password in its global configuration encrypted and masks it using a password field.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Email Extension | =2.72 | |
| Jenkins Email Extension | =2.73 | |
| maven/org.jenkins-ci.plugins:email-ext | >=2.72<2.74 | 2.74 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2020/08/12/4
- https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1975
- https://nvd.nist.gov/vuln/detail/CVE-2020-2232
- https://github.com/jenkinsci/email-ext-plugin/commit/b51497d044e36e950d698a79bb781ef4c83a251c
- https://github.com/advisories/GHSA-5c4v-vh95-c67c (Advisory)
Frequently Asked Questions
What is CVE-2020-2232?
CVE-2020-2232 is a vulnerability in the Jenkins Email Extension Plugin versions 2.72 and 2.73.
What is the severity of CVE-2020-2232?
CVE-2020-2232 has a severity rating of 7.5 (high).
How does CVE-2020-2232 affect Jenkins Email Extension Plugin?
CVE-2020-2232 allows the SMTP password to be transmitted and displayed in plain text as part of the global Jenkins configuration form, potentially exposing it.
Which versions of Jenkins Email Extension Plugin are affected by CVE-2020-2232?
CVE-2020-2232 affects versions 2.72 and 2.73 of the Jenkins Email Extension Plugin.
How can I fix CVE-2020-2232?
To fix CVE-2020-2232, update Jenkins Email Extension Plugin to a version beyond 2.73 that includes the necessary security fixes.
- collector/nvd-index
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-5c4v-vh95-c67c
- alias/CVE-2020-2232
- collector/nvd-cve
- collector/github-advisory
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/jenkins
- canonical/jenkins email extension
- version/jenkins email extension/2.72
- version/jenkins email extension/2.73
- package-manager/maven