CVE-2023-25765

Name of the Vulnerable Software and Affected Versions Jenkins Email Extension Plugin versions 2.93 and earlier

Description The issue is related to insufficient access control in the Jenkins Email Extension Plugin, allowing attackers who can define email templates in folders to bypass sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. This is due to templates defined inside a folder not being subject to Script Security protection.

Recommendations For Jenkins Email Extension Plugin versions 2.93 and earlier, update to a version that includes the fix for this issue to prevent attackers from executing arbitrary code. At the moment, there is no information about a newer version that contains a fix for this vulnerability.