What is CVE-2023-37943?

CVE-2023-37943 is a medium-severity vulnerability in Jenkins Active_directory, classified under Missing Encryption of Sensitive Data. CVSS score: 5.9/10. Published 2023-07-12.

How severe is CVE-2023-37943?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Jenkins Active_directory

CVE-2023-37943

Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to capture network traffic between the Jenki…

EPSS: 0.005 (37.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Jenkins Active_directory
Jenkins Project Active Directory Plugin — versions 0

Weakness classification (CWE)

CWE-311 — Missing Encryption of Sensitive Data

References

jenkinsci-cert@googlegroups.com (vendor-advisory, Vendor Advisory)
jenkinsci-cert@googlegroups.com (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2023-37943?: CVE-2023-37943 is a medium-severity vulnerability in Jenkins Active_directory, classified under Missing Encryption of Sensitive Data. CVSS score: 5.9/10. Published 2023-07-12.
How severe is CVE-2023-37943?: Medium severity. CVSS v3 base score is 5.9 out of 10.