GitHub Advisoryadvisory · Maven

GHSA-8wcw-cw2f-h4g2 Improper Authentication (empty password) in Jenkins Active Directory Plugin

CRITICAL Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2020-2300
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:active-directory
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2022-09-08

Affected packages

• Maven org.jenkins-ci.plugins:active-directory: >= 2.17, < 2.20 → fixed in 2.20 • Maven org.jenkins-ci.plugins:active-directory: < 2.16.1 → fixed in 2.16.1

Description

Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode. The Windows/ADSI mode does not specifically prohibit use of empty passwords in Active Directory Plugin prior to 2.20 and 2.16.1. If the Active Directory server allows the unauthenticated bind operation, this allows attackers to log in to Jenkins as any user by providing an empty password. Jenkins Active Directory Plugin 2.20 and 2.16.1 prohibits the use of an empty password to log in.

Related

Alias · CVE (1)

  • CVE-2020-2300 Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References