TI-2018-15825 Aliases CVE-2018-1000176 GHSA-gwxm-wqpq-w539

An exposure of sensitive information vulnerability exists in Jenkins Email Extension…

LOW 31CWE-200Published 2018-05-08 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/ExtendedEmailPublisher/global.groovy and ExtendedEmailPublisherDescriptor.java that allows attackers with control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured SMTP password.

Why it matters now

EPSS 0.0097 62nd percentileScored 2026-11-07

Fix Fixed org.jenkins-ci.plugins:email-ext (Maven): 2.62

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	org.jenkins-ci.plugins:email-ext (Maven)	before 2.62	2.62	Patch available	GHSA-gwxm-wqpq-w539

— Vendor— Affected all versions Fixed in — No fix listed CNA
org.jenkins-ci.plugins:email-ext (Maven) Vendor— Affected before 2.62 Fixed in 2.62 Patch available GHSA-gwxm-wqpq-w539

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:email_extension::::::jenkins::*	up to 2.61	Vulnerable	Jenkins

cpe:2.3:a:jenkins:email_extension:*:*:*:*:*:jenkins:*:* Versions up to 2.61 Vulnerable ·Jenkins

Remediation

Fix · GHSA-gwxm-wqpq-w539 org.jenkins-ci.plugins:email-ext (Maven) Fixed in 2.62 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2018-1000176
2026-10-03 Alias added: GHSA-gwxm-wqpq-w539

References

Advisory 2

Other 1

https://jenkins.io/security/advisory/2018-04-16

TI-2019-15877 Protection mechanism failure in Jenkins Email Extension Plugin CVSS 3.1CRITICAL 9.9
TI-2023-11037 Protection mechanism failure in Jenkins Email Extension Plugin CVSS 3.1CRITICAL 9.9
TI-2026-36179 Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as… CVSS 3.1HIGH 8.8
TI-2020-02109 Cleartext transmission of sensitive information in Jenkins Email Extension Plugin CVSS 3.1HIGH 7.5
TI-2017-01904 Information disclosure in [UNKNOWN] jenkins-email-ext CVSS 3.0MEDIUM 5.3
TI-2023-11036 Cross-site scripting in Jenkins Email Extension Plugin CVSS 3.1MEDIUM 5.4

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences