CVE-2019-1003009

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.

Score

CVSS 3.0 7.4 High

Status

Modified - jenkinsci-cert@googlegroups.com

Published

2019-02-06

Last modified

2024-09-16

Weaknesses

CWE-295

Affected products

• Active Directory (Jenkins)
• Jenkins Active Directory Plugin (Jenkins Project)

References

• https://jenkins.io/security/advisory/2019-01-28/#SECURITY-859