User passwords transmitted in plain text by Jenkins Active Directory Plugin

中危 6.5CVE-2022-23105 · GHSA-c8cc-hj57-vm65 · Published 12/01/2022 · updated 17/06/2026

要点

CVE-2022-23105 是影响 org.jenkins-ci.plugins:active-directory, active directory (jenkins) 的中危 (CVSS 6.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.45%，高于 39.0% 的漏洞。
修复：升级到 2.25.1 或更高版本。

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:active-directory Maven	`< 2.25.1`	`2.25.1`
active directory jenkins	`≤ 2.25`	No fix yet

Description

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations.

NVD description

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations.

References

nvd.nist.gov/vuln/detail/CVE-2022-23105 · ADVISORY
jenkinsci/active-directory-plugin commit 07b05f8 · WEB
jenkinsci/active-directory-plugin · PACKAGE
jenkins.io/security/advisory/2022-01-12 · WEB
openwall.com/lists/oss-security/2022/01/12/6 · WEB

org.jenkins-ci.plugins:active-directory 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:active-directory

Maven

< 2.25.1

2.25.1

active directory

jenkins

≤ 2.25

No fix yet

Description

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations.

NVD description

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations.

org.jenkins-ci.plugins:active-directory 的其他漏洞

查看全部 →