jenkins-email-ext における情報漏えいに関する脆弱性
| Title |
jenkins-email-ext における情報漏えいに関する脆弱性
|
| Summary |
jenkins-email-ext には、情報漏えいに関する脆弱性が存在します。
|
| Possible impacts |
情報を取得される可能性があります。 |
| Solution |
ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date |
March 20, 2017, midnight |
| Registration Date |
Nov. 12, 2018, 4:03 p.m. |
| Last Update |
Nov. 12, 2018, 4:03 p.m. |
|
CVSS3.0 : 警告
|
| Score |
5.3
|
| Vector |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
CVSS2.0 : 警告
|
| Score |
5
|
| Vector |
AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected System
| Jenkins プロジェクト |
|
Email Extension Plugin 2.57.1 未満
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2018年11月12日]
掲載 |
Nov. 12, 2018, 4:03 p.m. |
NVD Vulnerability Information
CVE-2017-2654
| Summary |
jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.
|
| Publication Date |
Aug. 7, 2018, 7:29 a.m. |
| Registration Date |
Jan. 26, 2021, 1:22 p.m. |
| Last Update |
Nov. 21, 2024, 12:23 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:jenkins:email_extension:*:*:*:*:*:jenkins:*:* |
|
|
|
2.57.1 |
Related information, measures and tools
Common Vulnerabilities List