PkgSeer

Vulnerability GHSA-2wf5-4mf7-vmh3

Medium Risk

4 years ago

CSRF vulnerability in Jenkins Active Directory Plugin

1.18.0 - 1.39.0 and 1.41.0 - 2.19.0

Summary

CSRF vulnerability in Jenkins Active Directory Plugin

Details

Jenkins Active Directory Plugin 2.19 and earlier does not require POST requests for multiple HTTP endpoints implementing connection and authentication tests, resulting in cross-site request forgery (CSRF) vulnerabilities.

This vulnerability allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified credentials.

Active Directory Plugin 2.20 requires POST requests for the affected HTTP endpoints.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Jenkins Active Directory Plugin has an LDAP injection vulnerability

1.18.0 - 1.39.0 and 1.41.0 - 2.20.0 and 2.22.0 - 2.41.1 GHSA-gx55-p8g7-p3fh

Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation

1.18.0 - 1.39.0 and 1.41.0 - 2.20.0 and 2.22.0 - 2.41.0 GHSA-p2gw-f3rv-82mw

Jenkins Active Directory Plugin follows LDAP referrals by default

1.18.0 - 1.39.0 and 1.41.0 - 2.20.0 and 2.22.0 - 2.41.0 GHSA-wrhr-54p6-q97f

Jenkins Active Directory Plugin vulnerable to Active Directory credential disclosure

1.18.0 - 1.39.0 and 1.41.0 - 2.20.0 and 2.22.0 - 2.30.0 GHSA-g8c3-6fj2-87w7

Improper Authentication (empty password) in Jenkins Active Directory Plugin

1.18.0 - 1.39.0 and 1.41.0 - 2.19.0 GHSA-8wcw-cw2f-h4g2

View all vulnerabilities for these packages

Impacted packages

org.jenkins-ci.plugins:active-directory

Timeline

Published

4 years ago

Last Modified

2 years ago