CVE-2022-23105

CVE-2022-23105 affects Jenkins Active Directory Plugin 2.25 and earlier. The vulnerability stems from the plugin not encrypting data transmitted between the Jenkins controller and Active Directory servers in most configurations, enabling potential information disclosure. Connected advisories refe...

CVE-2020-2301

The CVE-2020-2301 issue affects Jenkins Active Directory Plugin (versions 2.19 and earlier). In Windows/ADSI mode, the plugin’s authentication cache could cause a login to be successful for any user with any password because the provided password was not validated when a cache entry existed. This...

CVE-2020-2299

CVE-2020-2299 affects Jenkins Active Directory Plugin versions 1.44–2.19 and certain older ranges, where the LDAP-based mode distinguishes user lookup from authentication by using a magic constant as the password due to shared code paths. This allows an attacker to log in as any user when the mag...

CVE-2020-2302

CVE-2020-2302 affects Jenkins Active Directory Plugin 2.19 and earlier, where a missing permission check allows attackers with Overall/Read permission to access the domain health check diagnostic page. The issue is fixed by upgrading to version 2.20, which enforces Overall/Administer permission f...

CVE-2020-2300

CVE-2020-2300 affects Jenkins Active Directory Plugin ≥2.19 and earlier. In Windows/ADSI mode the plugin does not prohibit empty passwords, enabling unauthorized logins to Jenkins depending on Active Directory server configuration. Mitigation: upgrade to version 2.20 or 2.16.1 which prohibit empt...

CVE-2020-2303

CVE-2020-2303 describes a CSRF vulnerability in Jenkins Active Directory Plugin (versions 2.19 and earlier) that allows an attacker to trigger connection tests against AD servers using attacker-supplied credentials. The root cause is endpoints performing connection/authentication tests without re...

CVE-2017-2649

The CVE-2017-2649 entry concerns the Jenkins Active Directory Plugin (up to and including v2.2) that did not verify certificates when connecting to the Active Directory server, enabling Man-in-the-Middle attacks. Affected component: Jenkins Active Directory Plugin; root cause: certificate verific...

CVE-2019-1003009

The CVE-2019-1003009 issue affects Jenkins Active Directory Plugin 2.10 and earlier. A improper certificate validation vulnerability exists in ActiveDirectoryDomain.java, ActiveDirectorySecurityRealm.java, and ActiveDirectoryUnixAuthenticationProvider.java that lets an attacker impersonate the Ac...

CVE-2023-37943

The CVE concerns Jenkins Active Directory Plugin (versions 2.30 and earlier). The root cause is that the plugin ignores the TLS-related options (Require TLS and StartTLS) during a test connection, causing the test against Active Directory to run unencrypted. This can allow an attacker who can obs...

CVE-2026-48918

Technical details about CVE-2026-48918 are not publicly available in the provided documents; monitor for updates from official advisories (e.g., Jenkins security notices) for new information.

CVE-2026-48919

CVE-2026-48919 affects Jenkins’ Active Directory Plugin (2.41 and earlier). The root cause is that the plugin deserializes data from LDAP referrals without validation. This leads to potential impact on confidentiality, integrity, and availability (CVSS v3.1 base score 6.6, MEDIUM). The exploitati...

CVE-2026-57288

CVE-2026-57288 — Jenkins Active Directory Plugin versions up to 2.41.1 are affected. The vulnerability arises because the plugin does not escape the user name before building the LDAP search filter in the Windows native ADSI authentication path, enabling unauthenticated attackers to inject LDAP w...