CVE-2020-2232: High severity jenkins email extension template vulnerability
Email Extension Plugin stores an SMTP password in its global configuration file hudson.plugins.emailext.ExtendedEmailPublisher.xml on the Jenkins controller as part of its configuration.
While this password is stored encrypted on disk, it is transmitted and displayed in plain text as part of the configuration form by Email Extension Plugin 2.72 and 2.73. This can result in exposure of the password.
Email Extension Plugin 2.74 transmits the SMTP password in its global configuration encrypted and masks it using a password field.
Other sources
Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potentially resulting in its exposure.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-2232?
CVE-2020-2232 is a vulnerability in the Jenkins Email Extension Plugin versions 2.72 and 2.73.
What is the severity of CVE-2020-2232?
CVE-2020-2232 has a severity rating of 7.5 (high).
How does CVE-2020-2232 affect Jenkins Email Extension Plugin?
CVE-2020-2232 allows the SMTP password to be transmitted and displayed in plain text as part of the global Jenkins configuration form, potentially exposing it.
Which versions of Jenkins Email Extension Plugin are affected by CVE-2020-2232?
CVE-2020-2232 affects versions 2.72 and 2.73 of the Jenkins Email Extension Plugin.
How can I fix CVE-2020-2232?
To fix CVE-2020-2232, update Jenkins Email Extension Plugin to a version beyond 2.73 that includes the necessary security fixes.