CVE-2023-32979

Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3088%20(1)	Vendor Advisory
https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3088%20(1)	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:email_extension:*:*:*:*:*:jenkins:*:*

History

28 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El Plugin de Extensión de Correo Electrónico de Jenkins no realiza una verificación de permisos en un método que implementa la validación de formularios, permitiendo a atacantes con permiso General/Lectura verificar la existencia de archivos en el directorio email-templates/ en el directorio de inicio de Jenkins en el sistema de archivos del controlador.

Information

Published : 2023-05-16 16:15

Updated : 2026-10-28 19:10

NVD link : CVE-2023-32979

Mitre link : CVE-2023-32979

CVE.ORG link : CVE-2023-32979

JSON object : View

Products Affected

jenkins

email_extension

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2023-32979", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-32979", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-23T16:03:36.350483Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "jenkinsci-cert@googlegroups.com", "affectedData": [{"vendor": "Jenkins Project", "product": "Jenkins Email Extension Plugin", "versions": [{"status": "unaffected", "version": "2.96.1", "lessThan": "*", "versionType": "maven"}, {"status": "unaffected", "version": "2.89.0.2", "lessThan": "2.89.0.*", "versionType": "maven"}], "defaultStatus": "affected"}]}], "published": "2023-05-16T16:15:10.673", "references": [{"url": "https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3088%20(1)", "tags": ["Vendor Advisory"], "source": "jenkinsci-cert@googlegroups.com"}, {"url": "https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3088%20(1)", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system."}, {"lang": "es", "value": "El Plugin de Extensi\u00f3n de Correo Electr\u00f3nico de Jenkins no realiza una verificaci\u00f3n de permisos en un m\u00e9todo que implementa la validaci\u00f3n de formularios, permitiendo a atacantes con permiso General/Lectura verificar la existencia de archivos en el directorio email-templates/ en el directorio de inicio de Jenkins en el sistema de archivos del controlador."}], "lastModified": "2026-10-28T19:10:00.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:email_extension:*:*:*:*:*:jenkins:*:*", "vulnerable": true, "matchCriteriaId": "9535EDB3-7B12-415E-BF46-065A4840C828", "versionEndIncluding": "2.96"}], "operator": "OR"}]}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com"}