Jenkins Active_directory
12 CVEs affecting Jenkins Active_directory. Latest disclosed: 2026-06-24. Critical: 3, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-2301 | Critical | 9.8 | 2020-11-04 | Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is sti… |
CVE-2020-2300 | Critical | 9.8 | 2020-11-04 | Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenki… |
CVE-2020-2299 | Critical | 9.8 | 2020-11-04 | Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password. |
CVE-2017-2649 | High | 8.1 | 2018-07-27 | It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby e… |
CVE-2019-1003009 | High | 7.4 | 2019-02-06 | An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/Ac… |
CVE-2026-48919 | Medium | 6.6 | 2026-05-27 | Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation. |
CVE-2026-48918 | Medium | 6.6 | 2026-05-27 | Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default. |
CVE-2022-23105 | Medium | 6.5 | 2022-01-12 | Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most… |
CVE-2023-37943 | Medium | 5.9 | 2023-07-12 | Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory u… |
CVE-2020-2303 | Medium | 4.3 | 2020-11-04 | A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting… |
CVE-2020-2302 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check… |
CVE-2026-57288 | Low | 3.7 | 2026-06-24 | Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentica… |