VYPR
← All advisories
Moderate severityNVD Advisory· Published Sep 16, 2020· Updated Aug 4, 2024

CVE-2020-2253

CVE-2020-2253

Description

Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Jenkins Email Extension Plugin ≤2.75 skips SMTP hostname validation, enabling man-in-the-middle attacks.

Vulnerability

Overview CVE-2020-2253 affects the Jenkins Email Extension Plugin (email-ext) versions 2.75 and earlier. The plugin fails to validate the SMTP server's hostname when establishing a connection. This missing validation allows an attacker to impersonate the SMTP server without the client verifying the server's identity [1][2].

Attack

Vector An attacker in a position to perform a man-in-the-middle attack on the network between Jenkins and the SMTP server can exploit this flaw. No prior authentication is required; the attack takes place during the TLS handshake when the plugin connects to the configured SMTP host. By presenting a forged certificate, the attacker can intercept the communication [2][4].

Impact

Successful exploitation lets the attacker intercept, read, or modify email notifications sent by Jenkins. This could expose sensitive information contained in build notifications, such as credentials, source code snippets, or internal project data. The vulnerability is rated Medium severity (CVSS) [2].

Remediation

Fixed in version 2.76 of the plugin, which enables SMTP hostname validation by default when connecting via TLS. Administrators using earlier versions can also enable the Java system property mail.smtp.ssl.checkserveridentity to mitigate the issue until the plugin is upgraded [2][3].

References
  1. GitHub - jenkinsci/email-ext-plugin: Jenkins Email Extension Plugin
  2. Jenkins Security Advisory 2020-09-16
  3. security - Multiple vulnerabilities in Jenkins plugins
  4. NVD - CVE-2020-2253

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.plugins:email-extMaven
< 2.762.76

Affected products

2

Patches

1
ac039ba581f5

[SECURITY-1851]

https://github.com/jenkinsci/email-ext-pluginAlex EarlSep 10, 2020via ghsa
commit
1 file changed · +7 −0
  • src/main/java/hudson/plugins/emailext/ExtendedEmailPublisherDescriptor.java+7 −0 modified
    @@ -300,6 +300,13 @@ public Session createSession(String from) throws MessagingException {
                 props.put("mail.smtp.socketFactory.class", "javax.net.ssl.SSLSocketFactory");
             }
             props.put("mail.smtp.socketFactory.fallback", "false");
+
+            // RFC 2595 specifies additional checks that must be performed on the server's
+            // certificate to ensure that the server you connected to is the server you intended
+            // to connect to. This reduces the risk of "man in the middle" attacks.
+            if (props.getProperty("mail.smtp.ssl.checkserveridentity") == null) {
+                props.put("mail.smtp.ssl.checkserveridentity", "true");
+            }
         }
         if (!StringUtils.isBlank(acc.getSmtpUsername())) {
             props.put("mail.smtp.auth", "true");

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

1