User passwords transmitted in plain text by Jenkins Active Directory Plugin

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-23105 · ADVISORY
• jenkinsci/active-directory-plugin commit 07b05f8 · WEB
• jenkinsci/active-directory-plugin · PACKAGE
• jenkins.io/security/advisory/2022-01-12 · WEB
• openwall.com/lists/oss-security/2022/01/12/6 · WEB

More vulnerabilities in org.jenkins-ci.plugins:active-directory

• CVE-2026-57288LOW 3.7Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows nativ…
• CVE-2026-48919MEDIUM 6.6Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.
• CVE-2026-48918MEDIUM 6.6Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.
• CVE-2023-37943MEDIUM 5.9Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to…
• CVE-2020-2303MEDIUM 4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection…