Email Extension

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:email_extension:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

VendorJenkins (d708d718-2e77-5ca3-ae9c-38ee4d256744)
ProductEmail Extension (7bd7130e-0376-5b04-8f3e-6e162471ffc8)
Edition*
Language*
Software edition*
Target softwarejenkins
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/jenkinsci/email-ext-plugin purl2cpe 2026-06-01 10:14:09.471455

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2023-32980 vulnerable 2026-06-08 06:04:48.132691 Details available
A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified job.
Published: 2023-05-16T16:00:01.256Z
Updated: 2025-01-23T16:02:38.473Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-32979 vulnerable 2026-06-08 06:04:48.132271 Details available
Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system.
Published: 2023-05-16T16:00:00.471Z
Updated: 2025-01-23T16:04:34.885Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-25765 vulnerable 2026-06-08 05:56:10.500448 Details available
In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Published: 2023-02-15T00:00:00.000Z
Updated: 2025-03-19T16:20:52.614Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-25764 vulnerable 2026-06-08 05:56:10.500055 Details available
Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or change custom email templates.
Published: 2023-02-15T00:00:00.000Z
Updated: 2025-03-19T16:24:33.099Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-25763 vulnerable 2026-06-08 05:56:10.499455 Details available
Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control affected fields.
Published: 2023-02-15T00:00:00.000Z
Updated: 2025-03-19T18:47:34.681Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-2253 vulnerable 2026-06-08 05:24:59.170720 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-1003032 vulnerable 2026-06-08 05:12:21.442254 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-1000176 vulnerable 2026-06-08 05:10:25.583109 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2017-2654 vulnerable 2026-06-08 05:09:24.892146 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.