Non notée
CVE-2020-2300 Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode,…
Description
Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user depending on the configuration of the Active Directory server.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Jenkins Active Directory Plugin 2.19 | premières → 2.19 | Pas de correctif indiqué |
| Jenkins Active Directory Plugin 2.16 | premières → < 2.16.1 | 2.16.1 |
Références
- www.jenkins.io www.jenkins.io
- [oss-security] 20201104 Multiple vulnerabilities in Jenkins plugins www.openwall.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Jenkins Active Directory Plugin
Les 11 CVE de Jenkins Active Directory Plugin →
CVE-2026-57288
Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search…
3.7
Faible
CVE-2026-48918
Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default
6.6
Moyenne
CVE-2026-48919
Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation
6.6
Moyenne
CVE-2023-37943
Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs…
Non notée