CVEvulnerability
CVE-2023-25765
9.9 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2023-02-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weaknesses
- CWE-693
Description
In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Affected configurations
• jenkins email extension (< 2.93.1)
Related
Weakness · CWE (1)
- CWE-693 Protection Mechanism Failure weakness
References
- http://www.openwall.com/lists/oss-security/2023/02/15/4 Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2939 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/02/15/4 Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2939 Vendor Advisory