CVE-2020-2302

CVE-2020-2302 affects Jenkins Active Directory Plugin 2.19 and earlier, where a missing permission check allows attackers with Overall/Read permission to access the domain health check diagnostic page. The issue is fixed by upgrading to version 2.20, which enforces Overall/Administer permission f...

CVE-2020-2300

CVE-2020-2300 affects Jenkins Active Directory Plugin ≥2.19 and earlier. In Windows/ADSI mode the plugin does not prohibit empty passwords, enabling unauthorized logins to Jenkins depending on Active Directory server configuration. Mitigation: upgrade to version 2.20 or 2.16.1 which prohibit empt...

CVE-2020-2299

CVE-2020-2299 affects Jenkins Active Directory Plugin versions 1.44–2.19 and certain older ranges, where the LDAP-based mode distinguishes user lookup from authentication by using a magic constant as the password due to shared code paths. This allows an attacker to log in as any user when the mag...

PT-2020-15533 · Jenkins · Jenkins Active Directory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.19 and earlier Description: A cross-site request forgery CSRF issue allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers...

PT-2020-15531 · Jenkins · Jenkins Active Directory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.19 and earlier Jenkins Active Directory Plugin versions prior to 2.20 and 2.16.1 Description: The issue allows attackers to log in as any user with any password while a successful authentication of...

Input validation

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...

CVE-2019-1003009

The CVE-2019-1003009 issue affects Jenkins Active Directory Plugin 2.10 and earlier. A improper certificate validation vulnerability exists in ActiveDirectoryDomain.java, ActiveDirectorySecurityRealm.java, and ActiveDirectoryUnixAuthenticationProvider.java that lets an attacker impersonate the Ac...

CVE-2019-1003009

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...

PT-2019-11307 · Jenkins · Jenkins Active Directory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.10 and earlier Description: An issue exists in the improper validation of certificates, allowing attackers to impersonate the Active Directory server that Jenkins connects to for authentication when...

CVE-2017-2649

It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks...

CloudBees Jenkins Active Directory Plugin Security Bypass Vulnerability

Jenkins is the open source automation server.Jenkins provides numerous plug-ins to support building, deploying and automating projects.Jenkins Active Directory plug-in is one of the plug-ins to configure Jenkins via Active Directory authentication username and password. A security bypass...