CVE-2023-32979

Summary

Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system.

Affected Software

VendorProductVersion RangeStatus
Jenkins ProjectJenkins Email Extension Plugin2.96.1 < *unaffected
Jenkins ProjectJenkins Email Extension Plugin2.89.0.2 < 2.89.0.*unaffected

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References