| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:active-directory | < 2.20 | 2.20 |
| active directory | ≤ 2.19 |
Jenkins Active Directory Plugin 2.19 and earlier does not require POST requests for multiple HTTP endpoints implementing connection and authentication tests, resulting in cross-site request forgery (CSRF) vulnerabilities.
This vulnerability allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified credentials.
Active Directory Plugin 2.20 requires POST requests for the affected HTTP endpoints.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free