Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2020-2232

UNKNOWN
Published 2020-08-12T13:25:22
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2020-2232. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potentially resulting in its exposure.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

Jenkins project

Jenkins Email Extension Plugin

Affected Versions:

2.72 unspecified

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed LOW

Jenkins Email Extension Plugin SMTP password transmitted and displayed in plain text

GHSA-5c4v-vh95-c67c

Advisory Details

Email Extension Plugin stores an SMTP password in its global configuration file `hudson.plugins.emailext.ExtendedEmailPublisher.xml` on the Jenkins controller as part of its configuration. While this password is stored encrypted on disk, it is transmitted and displayed in plain text as part of the configuration form by Email Extension Plugin 2.72 and 2.73. This can result in exposure of the password. Email Extension Plugin 2.74 transmits the SMTP password in its global configuration encrypted and masks it using a password field.

Affected Packages

Maven org.jenkins-ci.plugins:email-ext
ECOSYSTEM: ≥2.72 <2.74

CVSS Scoring

CVSS Score

2.5

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2020-2232
WEB https://github.com/jenkinsci/email-ext-plugin/commit/b51497d044e36e950d698a79bb781ef4c83a251c
PACKAGE https://github.com/jenkinsci/email-ext-plugin
WEB https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1975
WEB http://www.openwall.com/lists/oss-security/2020/08/12/4

Advisory provided by GitHub Security Advisory Database. Published: May 24, 2022, Modified: December 20, 2022

References

https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1975
http://www.openwall.com/lists/oss-security/2020/08/12/4
Published: 2020-08-12T13:25:22
Last Modified: 2024-08-04T07:01:41.190Z
Copied to clipboard!