-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:email-ext | maven | <= 2.75 | 2.76 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing hostname validation during SMTP TLS handshakes. The commit diff shows the fix explicitly adds a check for 'mail.smtp.ssl.checkserveridentity' in the createSession() method, defaulting it to 'true' if unset. This method is responsible for configuring SMTP connection properties, and its failure to enforce hostname validation prior to the patch directly enabled the vulnerability. The CWE-295 mapping confirms this is an improper certificate validation issue.
Ongoing coverage of React2Shell