Description

Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server.

Remediation

References

https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1851

http://www.openwall.com/lists/oss-security/2020/09/16/3

Related Vulnerabilities

CVE-2021-30074 Vulnerability in npm package docsify

CVE-2014-3530 Vulnerability in maven package org.picketlink:picketlink-common

CVE-2022-25881 Vulnerability in npm package http-cache-semantics

CVE-2021-46708 Vulnerability in npm package swagger-ui-dist

CVE-2023-5217 Vulnerability in npm package electron

Severity

Medium

Classification

CWE-295 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Tags

Vendor Advisory Third Party Advisory