CVE-2023-32979: 
Java vulnerability analysis and mitigation

Jenkins Email Extension Plugin version 2.96 and earlier contains a security vulnerability (CVE-2023-32979) discovered in May 2023. The vulnerability affects the form validation functionality where the plugin fails to perform proper permission checks, potentially exposing sensitive information about files in the email-templates/ directory on the Jenkins controller file system (Jenkins Advisory).

The vulnerability stems from a missing permission check in a method implementing form validation in the Email Extension Plugin. This security flaw allows attackers who have Overall/Read permission to check for the existence of files in the email-templates/ directory within the Jenkins home directory on the controller file system. The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability enables attackers with Overall/Read permission to enumerate and verify the existence of files within the email-templates/ directory on the Jenkins controller file system. This could potentially lead to information disclosure about the system's configuration and structure (Jenkins Advisory).

The vulnerability has been fixed in Email Extension Plugin version 2.96.1. The updated version implements appropriate permission checks for the form validation method. Users are advised to upgrade to this version to mitigate the security risk (Jenkins Advisory).