CVE-2020-2299
First published: Wed Nov 04 2020(Updated: )
Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Active Directory | <=2.19 | |
| maven/org.jenkins-ci.plugins:active-directory | >=1.44<2.16.1 | 2.16.1 |
| maven/org.jenkins-ci.plugins:active-directory | >=2.17<2.20 | 2.20 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2020/11/04/6
- https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2117
- https://nvd.nist.gov/vuln/detail/CVE-2020-2299
- https://github.com/CVEProject/cvelist/blob/16860a328d970faa6e4350b0fa446f64a52e52ca/2020/2xxx/CVE-2020-2299.json
- https://github.com/jenkinsci/active-directory-plugin/commit/57e78ea7bb96b4e59405f28959ade2d26821163d
- https://github.com/advisories/GHSA-rf92-3vjr-w628 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2020-2299?
The severity of CVE-2020-2299 is critical with a CVSS score of 9.8.
What is the affected software of CVE-2020-2299?
The affected software of CVE-2020-2299 is Jenkins Active Directory Plugin versions 2.19 and earlier.
What is the vulnerability description of CVE-2020-2299?
CVE-2020-2299 is a vulnerability in Jenkins Active Directory Plugin that allows attackers to log in as any user.
How can the vulnerability be exploited?
The vulnerability can be exploited by attackers to log in as any user using the LDAP-based mode in Jenkins Active Directory Plugin.
How can I fix CVE-2020-2299?
To fix CVE-2020-2299, update Jenkins Active Directory Plugin to version 2.16.1 or higher.
- collector/nvd-index
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-rf92-3vjr-w628
- alias/CVE-2020-2299
- collector/github-advisory
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- agent/trending
- vendor/jenkins
- canonical/jenkins active directory
- version/jenkins active directory/2.19
- package-manager/maven