Missing permission check in Jenkins Active Directory Plugin allows accessing domain health check page

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-2302 · ADVISORY
• jenkinsci/active-directory-plugin commit e6b5f2b · WEB
• jenkinsci/active-directory-plugin · PACKAGE
• jenkins.io/security/advisory/2020-11-04 · WEB

org.jenkins-ci.plugins:active-directory のその他の脆弱性

• CVE-2026-57288低 3.7Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows nativ…
• CVE-2026-48919中 6.6Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.
• CVE-2026-48918中 6.6Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.
• CVE-2023-37943中 5.9Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to…
• CVE-2022-23105中 6.5Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directo…