En resumen
- CVE-2019-1003009 es una vulnerabilidad ALTO (CVSS 7.4) que afecta a org.jenkins-ci.plugins:active-directory, active directory (jenkins).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.78%, mayor que el 55.9% de las vulnerabilidades.
- Solución: actualizar a 2.11 o posterior.
Description
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.
NVD description
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.
Más vulnerabilidades de org.jenkins-ci.plugins:active-directory
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free