CVE-2017-2651 - CVE House
Back to Database
Status published Low CVE-2017-2651

jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure...

Vulnerability Description

jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-2651

Credits & Attribution

No credits recorded in the NVD database.

References

More from Jenkins

View All →
CVE-2024-9453
Jenkins-image: sensitive data disclosure when using openshift jenkins image
Medium 6.5
CVE-2023-2633
API keys stored and displayed in plain text by Code Dx Plugin
Medium 4.3
CVE-2023-2632
API keys stored and displayed in plain text by Code Dx Plugin
Medium 4.3
CVE-2023-2631
CSRF vulnerability and missing permission checks in Code Dx Plugin
Medium 4.3
CVE-2023-2196
Missing permission checks in Code Dx Plugin
Medium 4.3

Affected Vendor

Affected Software

jenkins-mailer-plugin
Vulnerable Versions:
1.20

Timeline

Official Publish: July 27th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration