CVE-2017-2654

Vulnerability

The Email Extension Plugin (jenkins-email-ext) before version 2.57.1 contains an information exposure vulnerability. The plugin can send emails to a dynamically created list of users based on changelogs, such as authors of SCM changes since the last successful build. Due to a mapping based on the local-part of email addresses, emails may be sent to individuals who have no user account in Jenkins or, in rare cases, to people not involved in the project. [1][2][3]

Exploitation

No direct attacker interaction is required; the vulnerability is triggered during normal Jenkins operation when a build triggers email notifications to changelog authors. An attacker does not need special authentication or network position beyond typical job configuration access. The issue arises from the plugin's email address resolution logic, which may incorrectly map local-parts to unintended recipients. [2]

Impact

The impact is information exposure: unintended recipients receive emails containing build details, potentially revealing sensitive project information, commit messages, or internal communications. This violates confidentiality and could lead to unintended disclosure of project activities. There is no direct privilege escalation, but information is leaked to unauthorized parties. [1][2]

Mitigation

The fix was released in version 2.57.1 of the Email Extension Plugin, published on 2017-03-20 as per the Jenkins security advisory. Users should upgrade to version 2.57.1 or later. No workaround is documented. [2]