Jenkins Active Directory Plugin (Jenkins Project) - vulnerabilities (CVEs)
11 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-06-24. Vendor: Jenkins Project.
CVEs of Jenkins Active Directory Plugin
- CVE-2026-57288 - CVSS 3.7 (low), 2026-06-24: Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI)…
- CVE-2026-48919 - CVSS 6.6 (medium), 2026-05-27: Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.
- CVE-2026-48918 - CVSS 6.6 (medium), 2026-05-27: Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.
- CVE-2023-37943 - CVSS 5.9 (medium), 2023-07-12: Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory…
- CVE-2022-23105 - CVSS 6.5 (medium), 2022-01-12: Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most…
- CVE-2020-2301 - CVSS 9.8 (critical), 2020-11-04: Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is…
- CVE-2020-2300 - CVSS 9.8 (critical), 2020-11-04: Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to…
- CVE-2020-2303 - CVSS 4.3 (medium), 2020-11-04: A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting…
- CVE-2020-2302 - CVSS 4.3 (medium), 2020-11-04: A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check…
- CVE-2020-2299 - CVSS 9.8 (critical), 2020-11-04: Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password.
- CVE-2019-1003009 - CVSS 7.4 (high), 2019-02-06: An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in…
