CVE-2020-2300

2020-11-0414:35:36

jenkins

www.cve.org

jenkins

active directory

security vulnerability

windows

adsi mode

empty password

authentication

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

64.7%

JSON

Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user depending on the configuration of the Active Directory server.

CNA Affected

[
  {
    "product": "Jenkins Active Directory Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "2.19",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "2.16.1"
      }
    ]
  }
]