GitHub Advisoryadvisory · Maven

GHSA-vcgj-j8c5-2h52 Jenkins Active Directory Plugin did not verify certificate of AD server

HIGH Published 2022-05-13 Modified 2024-01-30 Official page ↗
Aliases
CVE-2017-2649
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:active-directory
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-295
Reviewed
2024-01-30

Affected packages

• Maven org.jenkins-ci.plugins:active-directory: < 2.3 → fixed in 2.3

Description

It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks.

Related

Alias · CVE (1)

  • CVE-2017-2649 It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References