PkgSeer

Vulnerability GHSA-8wcw-cw2f-h4g2

Critical

4 years ago

Improper Authentication (empty password) in Jenkins Active Directory Plugin

1.18.0 - 1.39.0 and 1.41.0 - 2.19.0

Summary

Improper Authentication (empty password) in Jenkins Active Directory Plugin

Details

Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode.

The Windows/ADSI mode does not specifically prohibit use of empty passwords in Active Directory Plugin prior to 2.20 and 2.16.1. If the Active Directory server allows the unauthenticated bind operation, this allows attackers to log in to Jenkins as any user by providing an empty password.

Jenkins Active Directory Plugin 2.20 and 2.16.1 prohibits the use of an empty password to log in.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Jenkins Active Directory Plugin has an LDAP injection vulnerability

1.18.0 - 1.39.0 and 1.41.0 - 2.20.0 and 2.22.0 - 2.41.1 GHSA-gx55-p8g7-p3fh

Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation

1.18.0 - 1.39.0 and 1.41.0 - 2.20.0 and 2.22.0 - 2.41.0 GHSA-p2gw-f3rv-82mw

Jenkins Active Directory Plugin follows LDAP referrals by default

1.18.0 - 1.39.0 and 1.41.0 - 2.20.0 and 2.22.0 - 2.41.0 GHSA-wrhr-54p6-q97f

Jenkins Active Directory Plugin vulnerable to Active Directory credential disclosure

1.18.0 - 1.39.0 and 1.41.0 - 2.20.0 and 2.22.0 - 2.30.0 GHSA-g8c3-6fj2-87w7

CSRF vulnerability in Jenkins Active Directory Plugin

1.18.0 - 1.39.0 and 1.41.0 - 2.19.0 GHSA-2wf5-4mf7-vmh3

View all vulnerabilities for these packages

Impacted packages

org.jenkins-ci.plugins:active-directory

Timeline

Published

4 years ago

Last Modified

2 years ago