TI-2019-15877 Aliases CVE-2019-1003032 GHSA-qwm8-vgm6-f86p

Protection mechanism failure in Jenkins Email Extension Plugin

MEDIUM 47CWE-693Published 2019-03-08 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-693.

Summary

A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

Why it matters now

EPSS 0.02439 84th percentileScored 2026-11-07

Fix Fixed org.jenkins-ci.plugins:email-ext (Maven): 2.65

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins Email Extension Plugin	up to 2.64	—	No fix listed	CNA
—	org.jenkins-ci.plugins:email-ext (Maven)	before 2.65	2.65	Patch available	GHSA-qwm8-vgm6-f86p

Jenkins Email Extension Plugin VendorJenkins Affected up to 2.64 Fixed in — No fix listed CNA
org.jenkins-ci.plugins:email-ext (Maven) Vendor— Affected before 2.65 Fixed in 2.65 Patch available GHSA-qwm8-vgm6-f86p

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:email_extension::::::jenkins::*	up to 2.64	Vulnerable	Jenkins

cpe:2.3:a:jenkins:email_extension:*:*:*:*:*:jenkins:*:* Versions up to 2.64 Vulnerable ·Jenkins

Remediation

Fix · GHSA-qwm8-vgm6-f86p org.jenkins-ci.plugins:email-ext (Maven) Fixed in 2.65 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2019-1003032
2026-10-03 Alias added: GHSA-qwm8-vgm6-f86p

References

Advisory 2

Other 1

https://github.com/jenkinsci/email-ext-plugin

TI-2023-11037 Protection mechanism failure in Jenkins Email Extension Plugin CVSS 3.1CRITICAL 9.9
TI-2026-36179 Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as… CVSS 3.1HIGH 8.8
TI-2020-02109 Cleartext transmission of sensitive information in Jenkins Email Extension Plugin CVSS 3.1HIGH 7.5
TI-2018-15825 An exposure of sensitive information vulnerability exists in Jenkins Email Extension… CVSS 3.0MEDIUM 6.5
TI-2017-01904 Information disclosure in [UNKNOWN] jenkins-email-ext CVSS 3.0MEDIUM 5.3
TI-2023-11036 Cross-site scripting in Jenkins Email Extension Plugin CVSS 3.1MEDIUM 5.4

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences