CVE-2020-2232
First published: Wed Aug 12 2020(Updated: )
Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potentially resulting in its exposure.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Email Extension | =2.72 | |
| Jenkins Email Extension | =2.73 | |
| maven/org.jenkins-ci.plugins:email-ext | >=2.72<2.74 | 2.74 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2020/08/12/4
- https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1975
- https://nvd.nist.gov/vuln/detail/CVE-2020-2232
- https://github.com/jenkinsci/email-ext-plugin/commit/b51497d044e36e950d698a79bb781ef4c83a251c
- https://github.com/advisories/GHSA-5c4v-vh95-c67c (Advisory)
Frequently Asked Questions
What is CVE-2020-2232?
CVE-2020-2232 is a vulnerability in the Jenkins Email Extension Plugin versions 2.72 and 2.73.
What is the severity of CVE-2020-2232?
CVE-2020-2232 has a severity rating of 7.5 (high).
How does CVE-2020-2232 affect Jenkins Email Extension Plugin?
CVE-2020-2232 allows the SMTP password to be transmitted and displayed in plain text as part of the global Jenkins configuration form, potentially exposing it.
Which versions of Jenkins Email Extension Plugin are affected by CVE-2020-2232?
CVE-2020-2232 affects versions 2.72 and 2.73 of the Jenkins Email Extension Plugin.
How can I fix CVE-2020-2232?
To fix CVE-2020-2232, update Jenkins Email Extension Plugin to a version beyond 2.73 that includes the necessary security fixes.
- collector/nvd-index
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-5c4v-vh95-c67c
- alias/CVE-2020-2232
- collector/nvd-cve
- collector/github-advisory
- vendor/jenkins
- canonical/jenkins email extension
- version/jenkins email extension/2.72
- version/jenkins email extension/2.73
- package-manager/maven