CVE-2020-2299: Critical severity jenkins active directory vulnerability
Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password.
Other sources
Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode.
The LDAP-based mode in Active Directory Plugin starting in version 1.44 and prior to versions 2.16.1 and 2.20 shares code between user lookup and user authentication and distinguishes these behaviors through the use if a magic constant used in place of a real password. This allows attackers to log in as any user if the magic constant is used as the password in Active Directory Plugin prior to 2.16.1 and 220.
Active Directory Plugin 2.16.1 and 2.20 no longer uses a magic constant to distinguish between user lookup and user authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-2299?
The severity of CVE-2020-2299 is critical with a CVSS score of 9.8.
What is the affected software of CVE-2020-2299?
The affected software of CVE-2020-2299 is Jenkins Active Directory Plugin versions 2.19 and earlier.
What is the vulnerability description of CVE-2020-2299?
CVE-2020-2299 is a vulnerability in Jenkins Active Directory Plugin that allows attackers to log in as any user.
How can the vulnerability be exploited?
The vulnerability can be exploited by attackers to log in as any user using the LDAP-based mode in Jenkins Active Directory Plugin.
How can I fix CVE-2020-2299?
To fix CVE-2020-2299, update Jenkins Active Directory Plugin to version 2.16.1 or higher.