Skip to content
OpenAdvisories
Critical · 9.8 CVE-2020-2299 EUVD-2022-5159GHSA-rf92-3vjr-w628

Improper Authentication in Jenkins Active Directory Plugin

Published Nov 4, 2020 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Active Directory Plugin Package: org.jenkins-ci.plugins:active-directory Category: Web / CMS Ecosystem: Maven

Description

Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Active Directory Plugin 1.44 – < unspecified, unspecified – ≤ 2.19 unspecified

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:active-directory >= 2.17, < 2.20 2.20 GHSA-rf92-3vjr-w628
Maven org.jenkins-ci.plugins:active-directory >= 1.44, < 2.16.1 2.16.1 GHSA-rf92-3vjr-w628

References