Read the docs
TI-2020-02109 Aliases CVE-2020-2232GHSA-5c4v-vh95-c67c

Cleartext transmission of sensitive information in Jenkins Email Extension Plugin

Priority LOW 34CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-319.

Summary

Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potentially resulting in its exposure.

Why it matters now

EPSS 0.00755 55th percentileScored 2026-11-08
Fix Fixed org.jenkins-ci.plugins:email-ext (Maven): 2.74

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Email Extension Plugin2.72 and later; up to 2.73—No fix listedCNA
—org.jenkins-ci.plugins:email-ext (Maven)2.72 to before 2.742.74Patch availableGHSA-5c4v-vh95-c67c
  • Jenkins Email Extension Plugin VendorJenkins Affected 2.72 and later; up to 2.73 Fixed in — No fix listed CNA
  • org.jenkins-ci.plugins:email-ext (Maven) Vendor— Affected 2.72 to before 2.74 Fixed in 2.74 Patch available GHSA-5c4v-vh95-c67c

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:email_extension:2.72:*:*:*:*:jenkins:*:*2.72VulnerableJenkins
cpe:2.3:a:jenkins:email_extension:2.73:*:*:*:*:jenkins:*:*2.73VulnerableJenkins
  • cpe:2.3:a:jenkins:email_extension:2.72:*:*:*:*:jenkins:*:* Versions 2.72 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:email_extension:2.73:*:*:*:*:jenkins:*:* Versions 2.73 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-5c4v-vh95-c67c org.jenkins-ci.plugins:email-ext (Maven) Fixed in 2.74 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-2232
  2. 2026-10-03 Alias added: GHSA-5c4v-vh95-c67c

References

Advisory 3

Other 2

  • TI-2019-15877 Protection mechanism failure in Jenkins Email Extension Plugin CVSS 3.1CRITICAL 9.9
  • TI-2023-11037 Protection mechanism failure in Jenkins Email Extension Plugin CVSS 3.1CRITICAL 9.9
  • TI-2026-36179 Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as… CVSS 3.1HIGH 8.8
  • TI-2018-15825 An exposure of sensitive information vulnerability exists in Jenkins Email Extension… CVSS 3.0MEDIUM 6.5
  • TI-2017-01904 Information disclosure in [UNKNOWN] jenkins-email-ext CVSS 3.0MEDIUM 5.3
  • TI-2023-11036 Cross-site scripting in Jenkins Email Extension Plugin CVSS 3.1MEDIUM 5.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences