Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2020-2253

UNKNOWN
Published 2020-09-16T13:20:39
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2020-2253. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

Jenkins project

Jenkins Email Extension Plugin

Affected Versions:

unspecified 2.69.1 2.68.1

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed MODERATE

Missing hostname validation in Email Extension Plugin

GHSA-4qrj-99r6-jfrh

Advisory Details

Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections. Email Extension Plugin 2.76 validates the SMTP hostname when connecting via TLS by default. In Email Extension Plugin 2.75 and earlier, administrators can set the Java system property `mail.smtp.ssl.checkserveridentity` to `true` on startup to enable this protection. Alternatively, this protection can be enabled (or disabled in the new version) via the 'Advanced Email Properties' field in the plugin’s configuration in Configure System. In case of problems, this protection can be disabled again by setting `mail.smtp.ssl.checkserveridentity` to `false` using either method.

Affected Packages

Maven org.jenkins-ci.plugins:email-ext
ECOSYSTEM: ≥0 <2.76

CVSS Scoring

CVSS Score

5.0

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2020-2253
WEB https://github.com/jenkinsci/email-ext-plugin/commit/ac039ba581f5946975a327709ff201b459900caa
PACKAGE https://github.com/jenkinsci/email-ext-plugin
WEB https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1851
WEB http://www.openwall.com/lists/oss-security/2020/09/16/3

Advisory provided by GitHub Security Advisory Database. Published: May 24, 2022, Modified: December 14, 2023

References

https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1851
http://www.openwall.com/lists/oss-security/2020/09/16/3
Published: 2020-09-16T13:20:39
Last Modified: 2024-08-04T07:01:41.510Z
Copied to clipboard!