CVE-2017-2651

Vulnerability

The Jenkins Mailer Plugin (jenkins-mailer-plugin) versions before 1.20 provides a feature to send emails to a dynamically created list of users based on changelogs, such as "authors of SCM changes since the last successful build". Due to mapping based on the local-part of email addresses, emails could in some cases be sent to people who have no user account in Jenkins, and in rare cases even to people who were not involved in the project being built. [1][2][3]

Exploitation

The vulnerability is not actively exploitable by an attacker; it is triggered automatically when a Jenkins job uses the "send emails to authors of SCM changes" option. The plugin extracts email addresses from changelogs and, due to insufficient validation, may send emails to addresses derived from the local-part without verifying if those addresses belong to legitimate Jenkins users or project participants. [2]

Impact

Successful triggering results in information disclosure: the content of the emails (which may include project details) is sent to unintended recipients, potentially revealing project involvement and sensitive information to outsiders. No further privileges are gained. [1][2]

Mitigation

The issue is fixed in Mailer Plugin version 1.20, released on March 20, 2017. [2] Users should upgrade to version 1.20 or later. There is no known workaround for versions prior to 1.20.