CVE-2017-2649: High severity Jenkins Active Directory Jenkins vulnerability
It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-2649?
CVE-2017-2649 is a vulnerability found in the Active Directory Plugin for Jenkins up to and including version 2.2.
How does CVE-2017-2649 affect Jenkins?
CVE-2017-2649 allows for Man-in-the-Middle attacks by not verifying certificates of the Active Directory server in Jenkins.
What is the severity level of CVE-2017-2649?
CVE-2017-2649 has a severity level of 8.1 (high).
Where can I find more information about CVE-2017-2649?
You can find more information about CVE-2017-2649 at the following references: [SecurityFocus](http://www.securityfocus.com/bid/96986) and [Jenkins Security Advisory](https://jenkins.io/security/advisory/2017-03-20/).
How can I fix CVE-2017-2649?
To fix CVE-2017-2649, it is recommended to update the Active Directory Plugin for Jenkins to version 2.3 or later.