GitHub Advisoryadvisory · Maven
GHSA-c8cc-hj57-vm65 User passwords transmitted in plain text by Jenkins Active Directory Plugin
MEDIUM
Official page ↗
- Aliases
- CVE-2022-23105
- Ecosystem
- Maven
- Packages
- org.jenkins-ci.plugins:active-directory
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-319
- Reviewed
- 2022-11-29
Affected packages
• Maven org.jenkins-ci.plugins:active-directory: < 2.25.1 → fixed in 2.25.1
Description
Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations.
Related
Alias · CVE (1)
- CVE-2022-23105 Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active… vulnerability
Weakness · CWE (1)
- CWE-319 Cleartext Transmission of Sensitive Information weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-23105 advisory
- https://github.com/jenkinsci/active-directory-plugin/commit/07b05f83b167c79590f2efbdad8cb84fc98ed150 web
- https://github.com/jenkinsci/active-directory-plugin package
- https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-1389 web
- http://www.openwall.com/lists/oss-security/2022/01/12/6 web