GitHub Advisoryadvisory · Maven

GHSA-2h95-4xw9-m68j Jenkins Active Directory Plugin Improper certificate validation with StartTLS

HIGH Published 2022-05-13 Modified 2024-01-09 Official page ↗
Aliases
CVE-2019-1003009
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:active-directory
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2024-01-09

Affected packages

• Maven org.jenkins-ci.plugins:active-directory: < 2.11 → fixed in 2.11

Description

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.

Related

Alias · CVE (1)

  • CVE-2019-1003009 An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References