Cross-Site Request Forgery in Jenkins Mailer Plugin

Description

References

• nvd.nist.gov/vuln/detail/CVE-2018-8718 · ADVISORY
• jenkinsci/mailer-plugin commit 98e79cf · WEB
• jenkins.io/security/advisory/2018-03-26 · WEB
• exploit-db.com/exploits/44843 · WEB
• openwall.com/lists/oss-security/2018/03/26/3 · WEB
• securityfocus.com/bid/103691 · WEB
• jenkins.io/security/advisory/2018-03-26 · Vendor Advisory
• exploit-db.com/exploits/44843 · Exploit

More vulnerabilities in org.jenkins-ci.plugins:mailer

• CVE-2022-20614MEDIUM 4.3A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DN…
• CVE-2022-20613MEDIUM 4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS …
• CVE-2020-2252MEDIUM 4.8Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server.
• CVE-2017-2651LOW 3.7jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically…