CVE-2018-1000176

2018-05-0815:29:00

Google

osv.dev

0.001 Low

EPSS

Percentile

28.6%

JSON

An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/ExtendedEmailPublisher/global.groovy and ExtendedEmailPublisherDescriptor.java that allows attackers with control of a Jenkins administrator’s web browser (e.g. malicious extension) to retrieve the configured SMTP password.

CPENameOperatorVersion
email-ext-plugineqemail-ext-2.24.1
email-ext-plugineqemail-ext-2.40.3
email-ext-plugineqemail-ext-2.41.2
email-ext-plugineqemail-ext-2.53
email-ext-plugineqemail-ext-2.54
email-ext-plugineqemail-ext-2.40.2
email-ext-plugineqemail-ext-2.51
email-ext-plugineqemail-ext-2.20
email-ext-plugineqemail-ext-2.49
email-ext-plugineqemail-ext-2.60

Name	Operator	Version
email-ext-plugin	eq	email-ext-2.24.1
email-ext-plugin	eq	email-ext-2.40.3
email-ext-plugin	eq	email-ext-2.41.2
email-ext-plugin	eq	email-ext-2.53
email-ext-plugin	eq	email-ext-2.54
email-ext-plugin	eq	email-ext-2.40.2
email-ext-plugin	eq	email-ext-2.51
email-ext-plugin	eq	email-ext-2.20
email-ext-plugin	eq	email-ext-2.49
email-ext-plugin	eq	email-ext-2.60

Rows per page:

1-10 of 651

References

jenkins.io/security/advisory/2018-04-16/

0.001 Low

EPSS

Percentile

28.6%

JSON

Related for OSV:CVE-2018-1000176