CVE-2018-1000176

Vulnerability

The Jenkins Email Extension Plugin stores the SMTP password encrypted on disk, but transmits it in plain text as part of the global configuration form. This affects versions 2.61 and older [1][2]. The vulnerability exists in the ExtendedEmailPublisherDescriptor.java and the global configuration view global.groovy.

Exploitation

An attacker must have control over a Jenkins administrator's web browser, e.g., through a malicious browser extension or by exploiting a cross-site scripting vulnerability. The attacker can then view the configuration form and retrieve the SMTP password in plain text [2].

Impact

Successful exploitation allows the attacker to obtain the SMTP password configured for the Email Extension Plugin. This could enable the attacker to send emails as the Jenkins instance, potentially for phishing or further compromise [1][2].

Mitigation

Update the Email Extension Plugin to version 2.62 or later, released on 2018-04-16 [2]. After updating, the password is encrypted when transmitted to the configuration form.