CVE-2023-25765

In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

• CWE-693

• http://www.openwall.com/lists/oss-security/2023/02/15/4Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2939Vendor Advisory
• http://www.openwall.com/lists/oss-security/2023/02/15/4Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2939Vendor Advisory

Published

Feb 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2576An issue has been discovered in GitLab CE/EE affecting all v…4.3
• CVE-2023-25760Incorrect Access Control in Tripleplay Platform releases pri…8.8
• CVE-2023-25761Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does no…5.4
• CVE-2023-25762Jenkins Pipeline: Build Step Plugin 2.18 and earlier does no…5.4
• CVE-2023-25763Jenkins Email Extension Plugin 2.93 and earlier does not esc…5.4
• CVE-2023-25764Jenkins Email Extension Plugin 2.93 and earlier does not esc…5.4
• CVE-2023-25766A missing permission check in Jenkins Azure Credentials Plug…4.3
• CVE-2023-25767A cross-site request forgery (CSRF) vulnerability in Jenkins…8.8
• CVE-2023-25768A missing permission check in Jenkins Azure Credentials Plug…6.5
• CVE-2023-25769Uncontrolled resource consumption in some Intel(R) Thunderbo…5.5
• CVE-2023-25770Controller DoS may occur due to buffer overflow when an erro…7.5
• CVE-2023-25771Improper access control for some Intel(R) NUC BIOS firmware …5.5