Email Extension vulnerabilitiesRanked by how likely they are to be used.
Email Extension is made by Jenkins. We track 10 published vulnerabilities listed under that exact name, across 121 versions. None of them is on the list of flaws known to be exploited today. Jenkins lists newer releases under their own names, such as Email Extension Template, so check those pages too.
We keep watching the known-exploited list.
Is Email Extension listed under other names? Yes.
Jenkins also lists Email Extension under more specific names, such as Email Extension Template. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
Which Email Extension vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Email Extension's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Email Extension flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 2.4%CVE-2019-1003032Critical
A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java,...
- 1.1%CVE-2017-2654Medium
jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure.
- 1.1%CVE-2023-25765Critical
In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox...
- 1.0%CVE-2018-1000176Medium
An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/ExtendedEmailPublisher/global.groovy and...
- 0.8%CVE-2020-2232High
Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potentially resulting in its exposure.
- 0.7%CVE-2020-2253Medium
Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server.
- 0.6%CVE-2023-25763Medium
Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to...
- 0.6%CVE-2023-25764Medium
Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering, resulting in a stored cross-site scripting (XSS)...
- 0.5%CVE-2023-32979Medium
Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/...
- 0.4%CVE-2023-32980Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified job.
Running Email Extension? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
- Matched to
- Email Extension on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 10 published vulnerabilities listed under the name Email Extension, across 121 versions.
None of Email Extension's vulnerabilities is on the list of flaws known to be exploited today.
Jenkins also lists Email Extension under more specific names, such as Email Extension Template. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Create a Precursor Intelligence account and track Email Extension. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.