Lucene search

JenkinsCVE-2020-2301

HistoryNov 04, 2020 - 3:15 p.m.

CVE-2020-2301

2020-11-0415:15:11

jenkins

web.nvd.nist.gov

cve-2020-2301

jenkins

active directory plugin

unauthorized access

windows

adsi

security vulnerability

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

60.7%

JSON

Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode.

Affected configurations

Nvd

Node

jenkinsactive_directoryRange≤2.19jenkins

VendorProductVersionCPE
jenkinsactive_directory*cpe:2.3:a:jenkins:active_directory:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	active_directory	*	cpe:2.3:a:jenkins:active_directory::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins Active Directory Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "2.19",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "2.16.1"
      }
    ]
  }
]

References

www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2123

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

60.7%

JSON

Related for CVE-2020-2301