CVE-2020-2300
First published: Wed Nov 04 2020(Updated: )
Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user depending on the configuration of the Active Directory server.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Active Directory | <=2.19 | |
| maven/org.jenkins-ci.plugins:active-directory | <2.16.1 | 2.16.1 |
| maven/org.jenkins-ci.plugins:active-directory | >=2.17<2.20 | 2.20 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2020/11/04/6
- https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2099
- https://nvd.nist.gov/vuln/detail/CVE-2020-2300
- https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2300.json
- https://github.com/jenkinsci/active-directory-plugin/commit/57e78ea7bb96b4e59405f28959ade2d26821163d
- https://github.com/advisories/GHSA-8wcw-cw2f-h4g2 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2020-2300?
The severity of CVE-2020-2300 is critical with a severity value of 9.8.
How does the Jenkins Active Directory Plugin vulnerability work?
The vulnerability allows an attacker to use an empty password in Active Directory Plugin versions prior to 2.20 and 2.16.1.
Which versions of Jenkins Active Directory Plugin are affected by CVE-2020-2300?
Jenkins Active Directory Plugin versions 2.19 and earlier are affected.
What can an attacker do with this vulnerability?
An attacker can potentially bypass authentication and gain unauthorized access to the Jenkins Active Directory Plugin.
How can I fix the CVE-2020-2300 vulnerability in Jenkins Active Directory Plugin?
To fix the vulnerability, upgrade to Active Directory Plugin version 2.20 or 2.16.1.
- collector/nvd-index
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-8wcw-cw2f-h4g2
- alias/CVE-2020-2300
- collector/github-advisory
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- agent/trending
- vendor/jenkins
- canonical/jenkins active directory
- version/jenkins active directory/2.19
- package-manager/maven