What is GHSA-gwxm-wqpq-w539?

GHSA-gwxm-wqpq-w539 is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins Email Extension Plugin showed plain text SMTP password in configuration form field

Which CVE IDs does GHSA-gwxm-wqpq-w539 cover?

GHSA-gwxm-wqpq-w539 covers the following CVE IDs: CVE-2018-1000176. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gwxm-wqpq-w539?

GHSA-gwxm-wqpq-w539 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-gwxm-wqpq-w539?

GHSA-gwxm-wqpq-w539 affects 1 product, including: maven/org.jenkins-ci.plugins:email-ext:\u003c= 2.61.

GHSA-gwxm-wqpq-w539MediumCVSS 6.5

Jenkins Email Extension Plugin showed plain text SMTP password in configuration form field

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

January 30, 2024

🔗 CVE IDs covered (1)

CVE-2018-1000176 →

📋 Description

An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/ExtendedEmailPublisher/global.groovy and ExtendedEmailPublisherDescriptor.java that allows attackers with control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured SMTP password.

🎯 Affected products1

maven/org.jenkins-ci.plugins:email-ext:<= 2.61

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000176
https://jenkins.io/security/advisory/2018-04-16/
https://github.com/advisories/GHSA-gwxm-wqpq-w539