CVE-2022-20614

2022-01-1220:15:08

Google

osv.dev

4.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.4%

JSON

A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.

CPENameOperatorVersion
mailer-plugineqmailer-1.23
mailer-plugineqmailer-1.28
mailer-plugineqmailer-1.4
mailer-plugineqmailer-1.23-beta-2
mailer-plugineqmailer-1.32
mailer-plugineqmailer-1.15
mailer-plugineqmailer-1.20
mailer-plugineqmailer-1.34
mailer-plugineqmailer-1.5
mailer-plugineqmailer-1.6

Name	Operator	Version
mailer-plugin	eq	mailer-1.23
mailer-plugin	eq	mailer-1.28
mailer-plugin	eq	mailer-1.4
mailer-plugin	eq	mailer-1.23-beta-2
mailer-plugin	eq	mailer-1.32
mailer-plugin	eq	mailer-1.15
mailer-plugin	eq	mailer-1.20
mailer-plugin	eq	mailer-1.34
mailer-plugin	eq	mailer-1.5
mailer-plugin	eq	mailer-1.6