CVE-2020-2301
highPriorität · verfolgen · 40EPSS 0.017 · 77. PerzentilEUUSEPSS · bewertet 2026-10-27
Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (4)
Betroffene Produkte und Versionsbereiche.
- Maven org.jenkins-ci.plugins:active-directory< 2.16.1osvUSpkg:maven/org.jenkins-ci.plugins/active-directory
- Maven org.jenkins-ci.plugins:active-directory2.17 → 2.20osvUSpkg:maven/org.jenkins-ci.plugins/active-directory
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-954f-xw44-56r2Authentication cache in Active Directory Jenkins Plugin allows logging in with any password2022-05-24ghsa · osvUS
Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode. Optionally, to reduce lookup time, a cache can be configured to remember user lookups and user authentications. In Active Directory Plugin prior to 2.20 and 2.16.1, when run in Windows/ADSI mode, the provided password was not used when looking up an applicable cache entry. This allows attackers to log in as any user using any password while a successful authentication of that user is still in the cache. As a workaround for this issue, the cache can be disabled. Active Directory Plugin 2.20 and 2.16.1 includes the provided password in cache entry lookup. Additionally, the Java system property `hudson.plugins.active_directory.CacheUtil.noCacheAuth` can be set to `true` to no longer cache user authentications.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (7)
Externe Belege — Patches, Meldungen, Analysen.
- https://nvd.nist.gov/vuln/detail/CVE-2020-2301cnnvd
- https://vigilance.fr/vulnerability/Jenkins-Plugins-multiple-vulnerabilities-33806cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.3904/cnnvd
- https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2117Patchcnnvd
- https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2123cnnvd
- https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2123enisa_euvd
- https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2123Vendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan