Cleartext Transmission of Sensitive Information Affecting org.jenkins-ci.plugins:active-directory package, versions [,2.25.1)


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.07% (34th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JAVA-ORGJENKINSCIPLUGINS-3150930
  • published30 Nov 2022
  • disclosed13 Jan 2022
  • creditUnknown

Introduced: 13 Jan 2022

CVE-2022-23105  (opens in a new tab)
CWE-319  (opens in a new tab)

How to fix?

Upgrade org.jenkins-ci.plugins:active-directory to version 2.25.1 or higher.

Overview

Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information when it does not encrypt data transmission between the Jenkins controller and Active Directory servers in most configurations.

CVSS Scores

version 3.1