Jenkins Active Directory Plugin 2.19 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to access the domain health check diagnostic page.
Jenkins Active Directory Plugin 2.20 requires Overall/Administer permission to access the domain health check diagnostic page.
{ "nvd_published_at": "2020-11-04T15:15:00Z", "cwe_ids": [ "CWE-862" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2022-12-21T19:25:23Z" }