GHSA-8wcw-cw2f-h4g2

Source

https://github.com/advisories/GHSA-8wcw-cw2f-h4g2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-8wcw-cw2f-h4g2/GHSA-8wcw-cw2f-h4g2.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-8wcw-cw2f-h4g2

Aliases

CVE-2020-2300

Published

2022-05-24T17:33:07Z

Modified

2024-01-02T05:50:20.023848Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Improper Authentication (empty password) in Jenkins Active Directory Plugin

Details

Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode.

The Windows/ADSI mode does not specifically prohibit use of empty passwords in Active Directory Plugin prior to 2.20 and 2.16.1. If the Active Directory server allows the unauthenticated bind operation, this allows attackers to log in to Jenkins as any user by providing an empty password.

Jenkins Active Directory Plugin 2.20 and 2.16.1 prohibits the use of an empty password to log in.

Database specific

{
    "nvd_published_at": "2020-11-04T15:15:00Z",
    "cwe_ids": [
        "CWE-287"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-08T00:45:01Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:active-directory

Package

Name: org.jenkins-ci.plugins:active-directory; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/active-directory

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.17

Fixed

2.20

Affected versions

2.*

2.17

2.18

2.19

Maven / org.jenkins-ci.plugins:active-directory

Package

Name: org.jenkins-ci.plugins:active-directory; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/active-directory

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.16.1

Affected versions

1.*

1.18

1.19

1.20

1.21

1.22

1.23

1.24

1.25

1.26

1.27

1.28

1.29

1.30

1.31

1.32

1.33

1.34

1.35

1.36

1.37

1.38

1.39

1.41

1.42

1.43

1.44

1.45

1.46

1.47

1.48

1.49

2.*

2.0

2.1

2.2

2.3

2.4

2.5

2.6

2.7

2.8

2.9

2.10

2.11

2.12

2.13

2.14

2.15

2.16