Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to send test emails to an attacker-specified email address.
Jenkins requests-plugin Plugin 2.2.8 requires Overall/Administer permission to send test emails.
{ "nvd_published_at": "2021-06-30T17:15:00Z", "cwe_ids": [ "CWE-862" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2022-12-16T15:13:30Z" }