CVE-2023-25764

2023-02-1500:00:00

jenkins

www.cve.org

cve-2023-25764

jenkins

email extension plugin

cross-site scripting

xss

vulnerability

attackers

custom email templates

EPSS

0.001

Percentile

34.0%

JSON

Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or change custom email templates.

CNA Affected

[
  {
    "product": "Jenkins Email Extension Plugin",
    "vendor": "Jenkins Project",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "lessThanOrEqual": "2.93",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "2.89.0.1"
      }
    ]
  }
]