En bref
- CVE-2019-1003009 est une vulnérabilité ÉLEVÉE (CVSS 7.4) touchant org.jenkins-ci.plugins:active-directory, active directory (jenkins).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.78%, plus élevée que 55.9% des vulnérabilités.
- Correctif : mettre à jour vers 2.11 ou plus récent.
Description
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.
NVD description
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.
Autres vulnérabilités de org.jenkins-ci.plugins:active-directory
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free