Information Exposure Affecting org.jenkins-ci.plugins:active-directory package, versions [,2.30.1)


Severity

Recommended
0.0
low
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.14% (52nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JAVA-ORGJENKINSCIPLUGINS-5773367
  • published13 Jul 2023
  • disclosed12 Jul 2023
  • creditUnknown

Introduced: 12 Jul 2023

CVE-2023-37943  (opens in a new tab)
CWE-200  (opens in a new tab)

How to fix?

Upgrade org.jenkins-ci.plugins:active-directory to version 2.30.1 or higher.

Overview

Affected versions of this package are vulnerable to Information Exposure when it ignores the "Require TLS" and "StartTls" options and always performs the connection test to the Active Directory unencrypted. This allows attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.

Note:

This only affects the connection test. Connections established during the login process are encrypted if the corresponding TLS option is enabled.

CVSS Scores

version 3.1