CVE-2023-25764

· MEDIUMModified

← All CVEs

CVSS v3.1

5.4

EPSS

0.60%

Published

Feb 15, 2023

Modified

Mar 19, 2025

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or change custom email templates.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79CWE-79

Affected Products (1)

jenkins · email_extension (up to 2.93.1)vulnerable

References (4)

http://www.openwall.com/lists/oss-security/2023/02/15/4

Mailing ListThird Party Advisory

https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2934

Vendor Advisory

http://www.openwall.com/lists/oss-security/2023/02/15/4

Mailing ListThird Party Advisory

https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2934

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs