Description
A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Mailer Plugin | unspecified – ≤ 391.ve4a_38c1b_cf4b_ | 1.34.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:mailer | >= 391.ve4a38c1bcf4b, < 408.vd726a | 408.vd726a | GHSA-558x-h7rg-997v |
| Maven | org.jenkins-ci.plugins:mailer | < 1.34.2 | 1.34.2 | GHSA-558x-h7rg-997v |