CVE-2023-25765

State: Published
Severity: 9.9 Critical
Published: Feb 15, 2023
Updated: Mar 19, 2025
Reserved: Feb 14, 2023

Description

In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Scores

CVSS	Score	Vector	Source
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-693 Protection Mechanism Failure

Affected Products

Product	Versions
Jenkins Email Extension PluginJenkins Project	2.93 and earlierAffected 2.89.0.1Not affected

References

https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2939
[oss-security] 20230215 Multiple vulnerabilities in Jenkins pluginsmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.