GCVE - cpe:2.3:a:jenkins:mailer:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:mailer:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Mailer (`a3c14a88-a37a-54fb-ab43-278df5379856`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/jenkinsci/mailer-plugin`	purl2cpe	2026-06-01 10:14:18.174486

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-20614`	vulnerable	2026-06-08 05:39:52.680031	Details available A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname. Published: 2022-01-12T00:00:00.000Z Updated: 2024-08-03T02:17:52.949Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2163 http://www.openwall.com/lists/oss-security/2022/01/12/6 https://www.oracle.com/security-alerts/cpuapr2022.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-20613`	vulnerable	2026-06-08 05:39:52.677398	Details available A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname. Published: 2022-01-12T00:00:00.000Z Updated: 2024-08-03T02:17:52.870Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2163 http://www.openwall.com/lists/oss-security/2022/01/12/6 https://www.oracle.com/security-alerts/cpuapr2022.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-2252`	vulnerable	2026-06-08 05:24:59.169148	Details available Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server. Published: 2020-09-16T13:20:38.000Z Updated: 2024-08-04T07:01:41.144Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1813 http://www.openwall.com/lists/oss-security/2020/09/16/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-8718`	vulnerable	2026-06-08 05:12:06.354329	Details available Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request. Published: 2018-03-27T16:00:00.000Z Updated: 2024-08-05T07:02:26.081Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2018-03-26/ http://www.openwall.com/lists/oss-security/2018/03/26/3 https://www.exploit-db.com/exploits/44843/ http://www.securityfocus.com/bid/103691	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-2651`	vulnerable	2026-06-08 05:09:24.886490	Details available LOW (3.7) jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses. Published: 2018-07-27T18:00:00.000Z Updated: 2024-08-05T14:02:07.157Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/96984 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2651 https://jenkins.io/security/advisory/2017-03-20/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.