CVE-2023-32980

Vulnerability

Jenkins Email Extension Plugin has a cross-site request forgery (CSRF) vulnerability. This allows an attacker to perform actions on behalf of another user without their consent, specifically to make that user stop watching an attacker-specified job. The issue stems from insufficient CSRF protection in the plugin's endpoints.

Attack

Vector Exploitation requires an authenticated user to visit a malicious page crafted by the attacker. The attacker must specify the target job that the victim should stop watching. No additional privileges are needed beyond the victim's existing permissions in Jenkins.

Impact

An attacker can cause a victim to unknowingly cease monitoring a job, which could lead to missed build failures or other events. This disrupts the user's workflow and may delay incident response.

Mitigation

The Jenkins project has addressed this vulnerability in a security advisory [1]. Users should update the Email Extension Plugin to the latest version. No workarounds are mentioned.