{"id":"CVE-2022-20614","published":"2022-01-12T00:00:00Z","modified":"2024-08-03T02:17:52Z","title":"A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with…","vendor":"Jenkins","product":"Jenkins Mailer Plugin","tier":"tail","description":{"text":"A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0111,"percentile":0.65841,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2163","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2022/01/12/6","tags":["mailing-list"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":[]}],"priority":{"score":13.2,"factors":[{"name":"EPSS percentile","points":13.17}]},"vendorSlug":"jenkins","affectedVersions":[{"vendor":"Jenkins project","product":"Jenkins Mailer Plugin","versions":[">= unspecified, <= 391.ve4a_38c1b_cf4b_"]}],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:mailer","vulnerableRanges":[">=391.ve4a38c1bcf4b, <408.vd726a","<1.34.2"],"patched":["408.vd726a","1.34.2"],"from":["GHSA-558x-h7rg-997v"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0457","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-jenkins-mailer-plugin-cve-2020-2252","parents":[{"from":"CVE-2020-2252","to":"CVE-2022-20614","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:mailer","fromFixed":"1.32.1","toFixed":"1.34.2","daysApart":483},{"kind":"same-code","provenance":"machine","files":["src/main/java/hudson/tasks/Mailer.java"],"commits":["https://github.com/jenkinsci/mailer-plugin/commit/e1893c6d105669f134ee5c5212ef9f3944d7d00d","https://github.com/jenkinsci/mailer-plugin/commit/5e6051fae61a43564e22aa89cb24ed8a42a26052"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.42,"basis":"same product + description similarity"}]}],"packageHistory":[{"cve":"CVE-2018-8718","published":"2018-03-27","fixed":"1.21","kev":false},{"cve":"CVE-2020-2252","published":"2020-09-16","fixed":"1.32.1","kev":false},{"cve":"CVE-2022-20613","published":"2022-01-12","fixed":"408.vd726a","kev":false},{"cve":"CVE-2022-20614","published":"2022-01-12","fixed":"408.vd726a","kev":false}],"package":"Maven:org.jenkins-ci.plugins:mailer"}}