CVE-2020-2253
Missing hostname validation in Email Extension Plugin
Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server.
- Record
CVE-2020-2253- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server.
- Record
CVE-2020-2253- Updated
- 2026-11-02
EUVDEUVD-2022-2432 No score
Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server.
- Record
EUVD-2022-2432- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4qrj-99r6-jfrh
Missing hostname validation in Email Extension Plugin
Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.
Email Extension Plugin 2.76 validates the SMTP hostname when connecting via TLS by default. In Email Extension Plugin 2.75 and earlier, administrators can set the Java system property mail.smtp.ssl.checkserveridentity to true on startup to enable this protection. Alternatively, this protection can be enabled (or disabled in the new version) via the 'Advanced Email Properties' field in the plugin’s configuration in Configure System.
In case of problems, this protection can be disabled again by setting mail.smtp.ssl.checkserveridentity to false using either method.
- Record
GHSA-4qrj-99r6-jfrh- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV
Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server.
- Record
CVE-2020-2253- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-4qrj-99r6-jfrh
Missing hostname validation in Email Extension Plugin
Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.
Email Extension Plugin 2.76 validates the SMTP hostname when connecting via TLS by default. In Email Extension Plugin 2.75 and earlier, administrators can set the Java system property mail.smtp.ssl.checkserveridentity to true on startup to enable this protection. Alternatively, this protection can be enabled (or disabled in the new version) via the 'Advanced Email Properties' field in the plugin’s configuration in Configure System.
In case of problems, this protection can be disabled again by setting mail.smtp.ssl.checkserveridentity to false using either method.
- Record
GHSA-4qrj-99r6-jfrh- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:email-extMaven |
through 2.75 | 2.76 |
org.jenkins-ci.plugins:email-extMaven |
before 2.76, plus listed versions 2.112.122.132.142.14.1 Show 45 moreShow less2.152.162.182.192.202.212.222.24.12.252.272.27.12.282.292.302.30.12.30.22.312.322.332.342.352.35.12.362.372.37.12.37.22.37.2.22.382.38.12.38.22.392.39.32.402.40-beta2.40.12.40.22.40.32.40.42.40.52.412.41.22.41.32.422.432.44 |
2.76 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2253 is a medium vulnerability (CVSS 4.8) in Jenkins Email Extension, published September 16, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. Fixed in org.jenkins-ci.plugins:email-ext 2.76.
References
Left out here: 34 versions. The JSON record has them.