CVE-2023-32979
Aliases:GHSA-6gp4-2f92-j2w5
Advisory lineage Upstream: 0 Downstream: 1
Downstream
Modified
Published: 16 May 2023, 16:00
Last modified:23 Jan 2025, 16:04
Vulnerability Summary
Overall Risk (default)
low
17/100 CVSS Score
4.3 MEDIUM
v3.1 (cve.org)
EPSS Score
0.08% LOW
0% probability -0.02%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
16 May 2023, 16:00
Published
Vulnerability first disclosed
23 Jan 2025, 16:04
Last Modified
Vulnerability information updated
Description
Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system.
CVSS Metrics
- v3.1•MEDIUM•Score: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Trends
Current EPSS score: 0.08%• Percentile: 24%
Techniques & Countermeasures
- CWE-732•Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected Systems
- jenkins•email_extension
≤ 2.96
- org.jenkins-ci.plugins•email-ext
< 2.96.1