CVE-2019-1003032

CVE-2019-1003032: vulnerability in Jenkins Email Extension Plugin

Published · Updated

Follow this CVE+ Monitor Jenkins Email Extension Plugin+ Monitor org.jenkins-ci.plugins:email-ext

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.4%
A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
Affected products
Jenkins project · Jenkins Email Extension Plugin
Related CVEs — Jenkins Email Extension Plugin

In the same product, most dangerous first.

CVE-2020-2232—CVE-2020-2232EPSS 0.8%CVE-2020-2253—CVE-2020-2253EPSS 0.7%