CVE-2023-32979

MediumCVSS 4.3

Published: 16/05/2023(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

43th percentile - higher than 43% of all known CVEs

Summary

The Jenkins Email Extension Plugin does not perform a permission check in a form validation method, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller.

Risk Assessment

An attacker with low privileges can gain information about the file system structure, potentially aiding further attacks.

Recommendation

Update the Jenkins Email Extension Plugin to a patched version. Restrict Overall/Read permissions to necessary users.

Other vulnerabilities in Jenkins Email Extension Plugin

CVE-2026-48920High
Jenkins Email Extension Plugin version 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs. This allows attackers controlling the email content to specify `file:` URLs to read arbitrary files from the Jenkins controller filesystem.

Original NVD description (English source)

Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS