CVE-2023-37943
First published: Wed Jul 12 2023(Updated: )
Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Active Directory | <=2.30 | |
| <=2.30 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2023-37943
- https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3059
- http://www.openwall.com/lists/oss-security/2023/07/12/2
- https://github.com/jenkinsci/active-directory-plugin/commit/549dde617dbcf533e6cabfe8cc148a250a398211
- https://github.com/advisories/GHSA-g8c3-6fj2-87w7 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-37943.
What is the severity of CVE-2023-37943?
The severity of CVE-2023-37943 is medium.
What is the affected software?
The affected software is Jenkins Active Directory Plugin version 2.30 and earlier.
What is the fix for CVE-2023-37943?
To fix CVE-2023-37943, upgrade Jenkins Active Directory Plugin to version 2.30.1 or later.
Where can I find more information about CVE-2023-37943?
You can find more information about CVE-2023-37943 in the advisory from Jenkins, the OSS Security mailing list, and the NIST National Vulnerability Database.
- collector/nvd-api
- collector/nvd-latest
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-g8c3-6fj2-87w7
- alias/CVE-2023-37943
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/description
- collector/github-advisory
- source/GitHub
- agent/software-canonical-lookup
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/jenkins
- canonical/jenkins active directory
- version/jenkins active directory/2.30
- package-manager/maven