In short
- CVE-2019-1003009 is a HIGH (CVSS 7.4) vulnerability affecting org.jenkins-ci.plugins:active-directory, active directory (jenkins).
- Chance of exploitation in the next 30 days (EPSS): 0.78%, higher than 55.9% of all vulnerabilities.
- Fix: update to 2.11 or later.
Description
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.
NVD description
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.
More vulnerabilities in org.jenkins-ci.plugins:active-directory
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free