PT-2018-7157 · Jenkins · Jenkins Active Directory Plugin+1

Steven Christou · Publicado 2018-07-27 · Atualizado 2022-05-13 · CVE-2017-2649

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Active Directory Plugin for Jenkins versions up to and including 2.2

Description: The issue allows for Man-in-the-Middle attacks due to the lack of certificate verification of the Active Directory server.

Recommendations: For versions up to and including 2.2, update to a version that verifies certificates of the Active Directory server to prevent Man-in-the-Middle attacks.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2017-2649

GHSA-VCGJ-J8C5-2H52

Produtos afetados

Jenkins Active Directory Plugin

Jenkins

Referências · 5

• https://jenkins.io/security/advisory/2017-03-20 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2649 · Nota de Segurança
• http://securityfocus.com/bid/96986 · Nota
• https://osv.dev/vulnerability/CVE-2017-2649 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vcgj-j8c5-2h52 · Aviso do Fabricante