CVE-2023-25765

EPSS 0.03%
Published 15.02.2023 14:15:13
Last modified 19.03.2025 17:15:38
Source jenkinsci-cert@googlegroups.co
Teams watchlist Login
Open Login

In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Jenkins ≫ Email Extension SwPlatformjenkins Version < 2.93.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.03%	0.076

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.9	3.1	6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	9.9	3.1	6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-693 Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

http://www.openwall.com/lists/oss-security/2023/02/15/4

Third Party Advisory

Mailing List

https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2939

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-25765

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-25765

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-25765

EUVD