CVEvulnerability
CVE-2023-37943
5.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-07-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-311
Description
Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.
Affected configurations
• jenkins active directory (<= 2.30)
Related
Weakness · CWE (1)
- CWE-311 Missing Encryption of Sensitive Data weakness
References
- http://www.openwall.com/lists/oss-security/2023/07/12/2 Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3059 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/07/12/2 Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3059 Vendor Advisory