CVE-2018-8718

Cross-Site Request Forgery in Jenkins Mailer Plugin

8.0 HighPublic exploitFix available

Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

6.52%Up 0.9 points since Apr 14, 2021

What each source reports

NVD Score used 8.0

Record: CVE-2018-8718
CVSS 3.0: 8.0 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness: CWE-352
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-8718
Updated: 2026-11-02

EUVDEUVD-2022-2788 No score

Record: EUVD-2022-2788
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6g57-h38c-q52g 8.0

Cross-Site Request Forgery in Jenkins Mailer Plugin

Record: GHSA-6g57-h38c-q52g
CVSS 3.0: 8.0 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

OSV 8.0

Record: CVE-2018-8718
CVSS 3.0: 8.0 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-6g57-h38c-q52g 8.0

Cross-Site Request Forgery in Jenkins Mailer Plugin

Record: GHSA-6g57-h38c-q52g
CVSS 3.0: 8.0 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

Affected products

jenkins mailer

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.plugins:mailer` Maven	through 1.20	1.21
`org.jenkins-ci.plugins:mailer` Maven	before 1.21, plus listed versions 1.11.101.111.121.12-beta-1 Show 16 moreShow less 1.131.141.151.161.171.181.191.21.201.31.41.51.61.71.81.9	1.21

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Jenkins Mailer Plugin < 1.20 - Cross-Site Request Forgery (Send Email)	2018-06-05
PoC in GitHub	GeunSam2/CVE-2018-8718	2019-06-10

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-8718 is a high vulnerability (CVSS 8.0) in Jenkins Mailer, published March 27, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.52%, the 93rd percentile. Fixed in org.jenkins-ci.plugins:mailer 1.21.