jenkins-mailer-plugin における情報漏えいに関する脆弱性
| Title |
jenkins-mailer-plugin における情報漏えいに関する脆弱性
|
| Summary |
jenkins-mailer-plugin には、情報漏えいに関する脆弱性が存在します。
|
| Possible impacts |
情報を取得される可能性があります。 |
| Solution |
ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date |
March 20, 2017, midnight |
| Registration Date |
Oct. 17, 2018, 5:29 p.m. |
| Last Update |
Oct. 17, 2018, 5:29 p.m. |
|
CVSS3.0 : 低
|
| Score |
3.7
|
| Vector |
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
CVSS2.0 : 警告
|
| Score |
4.3
|
| Vector |
AV:N/AC:M/Au:N/C:P/I:N/A:N |
Affected System
| Jenkins プロジェクト |
|
Mailer 1.20 未満
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2018年10月17日]
掲載 |
Oct. 17, 2018, 5:29 p.m. |
NVD Vulnerability Information
CVE-2017-2651
| Summary |
jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.
|
| Publication Date |
July 28, 2018, 3:29 a.m. |
| Registration Date |
Jan. 26, 2021, 1:22 p.m. |
| Last Update |
Nov. 21, 2024, 12:23 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:jenkins:mailer:*:*:*:*:*:jenkins:*:* |
|
|
|
1.20 |
Related information, measures and tools
Common Vulnerabilities List