Vulnerabilities > CVE-2020-2301 - Unspecified vulnerability in Jenkins Active Directory

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

jenkins

critical

NVD

Published: 2020-11-04

Updated: 2023-10-25

Summary

Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode.

Vulnerable Configurations

Part	Description	Count
Application	Jenkins Jenkins Active Directory 1.0 Jenkins Active Directory 1.1 Jenkins Active Directory 1.2 Jenkins Active Directory 1.3 Jenkins Active Directory 1.4 Jenkins Active Directory 1.5 Jenkins Active Directory 1.6 Jenkins Active Directory 1.7 Jenkins Active Directory 1.8 Jenkins Active Directory 1.9 Jenkins Active Directory 1.10 Jenkins Active Directory 1.11 Jenkins Active Directory 1.12 Jenkins Active Directory 1.13 Jenkins Active Directory 1.14 Jenkins Active Directory 1.15 Jenkins Active Directory 1.16 Jenkins Active Directory 1.17 Jenkins Active Directory 1.18 Jenkins Active Directory 1.19 Jenkins Active Directory 1.20 Jenkins Active Directory 1.21 Jenkins Active Directory 1.22 Jenkins Active Directory 1.23 Jenkins Active Directory 1.24 Jenkins Active Directory 1.25 Jenkins Active Directory 1.26 Jenkins Active Directory 1.27 Jenkins Active Directory 1.28 Jenkins Active Directory 1.29 Jenkins Active Directory 1.30 Jenkins Active Directory 1.31 Jenkins Active Directory 1.32 Jenkins Active Directory 1.33 Jenkins Active Directory 1.34 Jenkins Active Directory 1.35 Jenkins Active Directory 1.36 Jenkins Active Directory 1.37 Jenkins Active Directory 1.38 Jenkins Active Directory 1.39 Jenkins Active Directory 1.40 Jenkins Active Directory 1.41 Jenkins Active Directory 1.42 Jenkins Active Directory 1.43 Jenkins Active Directory 1.44 Jenkins Active Directory 1.45 Jenkins Active Directory 1.46 Jenkins Active Directory 1.47 Jenkins Active Directory 1.48 Jenkins Active Directory 1.49 Jenkins Active Directory 2.0 Jenkins Active Directory 2.1 Jenkins Active Directory 2.2 Jenkins Active Directory 2.3 Jenkins Active Directory 2.4 Jenkins Active Directory 2.5 Jenkins Active Directory 2.6 Jenkins Active Directory 2.7 Jenkins Active Directory 2.8 Jenkins Active Directory 2.9 Jenkins Active Directory 2.10 Jenkins Active Directory 2.11 Jenkins Active Directory 2.12 Jenkins Active Directory 2.13 Jenkins Active Directory 2.14 Jenkins Active Directory 2.15 Jenkins Active Directory 2.16 Jenkins Active Directory 2.16.1 Jenkins Active Directory 2.17 Jenkins Active Directory 2.18 Jenkins Active Directory 2.19	71

References

https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2123