{"id":"CVE-2018-8718","aliases":["EUVD-2022-2788","GHSA-6g57-h38c-q52g"],"status":"published","title":"Cross-Site Request Forgery in Jenkins Mailer Plugin","description":"Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.","severity":{"version":"3.0","score":8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.06516,"percentile":0.93821,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-352"],"published":"2018-03-27T16:00:00Z","modified":"2026-10-24T10:30:30Z","exploits":[{"source":"exploitdb","id":"EDB-44843","title":"Jenkins Mailer Plugin \u003c 1.20 - Cross-Site Request Forgery (Send Email)","type":"webapps","platform":"linux","date":"2018-06-05","url":"https://www.exploit-db.com/exploits/44843"},{"source":"pocgithub","id":"GeunSam2/CVE-2018-8718","title":"GeunSam2/CVE-2018-8718","date":"2019-06-10","url":"https://github.com/GeunSam2/CVE-2018-8718"}],"fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:mailer","fixed_in":["1.21"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:mailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20"},{"fixed":"1.21"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:mailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21"}]}],"versions":["1.1","1.10","1.11","1.12","1.12-beta-1","1.13","1.14","1.15","1.16","1.17","1.18","1.19","1.2","1.20","1.3","1.4","1.5","1.6","1.7","1.8","1.9"]}],"products":[{"vendor":"jenkins","product":"mailer"}],"references":[{"url":"https://jenkins.io/security/advisory/2018-03-26/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2018/03/26/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.exploit-db.com/exploits/44843/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://www.securityfocus.com/bid/103691","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8718","tags":["advisory"]},{"url":"https://github.com/jenkinsci/mailer-plugin/commit/98e79cf904769907f83894e29f50ed6b3e7eb135","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6g57-h38c-q52g"},{"url":"https://jenkins.io/security/advisory/2018-03-26","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/44843","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-8718","description":"Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.","status":"published","published":"2018-03-27T16:00:00Z","modified":"2024-08-05T07:02:26.081Z","updated_at":"2026-11-02T14:35:04.172099Z"}],"euvd":[{"id":"EUVD-2022-2788","description":"Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.","status":"published","published":"2018-03-27T16:00:00Z","modified":"2024-08-05T07:02:26Z","updated_at":"2026-11-03T02:40:01.4233Z"}],"ghsa":[{"id":"GHSA-6g57-h38c-q52g","title":"Cross-Site Request Forgery in Jenkins Mailer Plugin","description":"Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.","status":"published","published":"2022-05-14T01:29:12Z","modified":"2024-01-03T13:02:00Z","cvss":[{"version":"3.0","score":8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:37:28.753349Z"}],"nvd":[{"id":"CVE-2018-8718","description":"Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.","status":"published","published":"2018-03-27T16:29:00.59Z","modified":"2026-06-17T02:05:17.22Z","cvss":[{"version":"3.0","score":8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:04:24.700429Z"}],"osv":[{"id":"CVE-2018-8718","description":"Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.","status":"published","published":"2018-03-27T16:29:00.59Z","modified":"2026-10-24T10:30:30.792188167Z","cvss":[{"version":"3.0","score":8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"GHSA-6g57-h38c-q52g","title":"Cross-Site Request Forgery in Jenkins Mailer Plugin","description":"Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.","status":"published","published":"2022-05-14T01:29:12Z","modified":"2024-02-18T05:24:26.53114Z","cvss":[{"version":"3.0","score":8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:39.618611Z"}]}}