PT-2023-26191 · Jenkins · Jenkins Active Directory Plugin+1

CVE-2023-37943 · Publicado 2023-07-12 · Atualizado 2023-07-20

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Active Directory Plugin versions 2.30 and earlier

Description The issue allows attackers to capture network traffic between the Jenkins controller and Active Directory servers, potentially obtaining Active Directory credentials. This occurs because the connection test to Active Directory is performed unencrypted, ignoring the "Require TLS" and "StartTls" options. The vulnerability only affects the connection test, as connections during the login process are encrypted if the corresponding TLS option is enabled.

Recommendations For Jenkins Active Directory Plugin versions 2.30 and earlier, update to version 2.30.1 or later to ensure that the "Require TLS" and "StartTls" options are considered for connection tests, thus encrypting the connection and protecting credentials.

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

Identificadores relacionados

CVE-2023-37943

GHSA-G8C3-6FJ2-87W7

Produtos afetados

Jenkins

Jenkins Active Directory Plugin

Referências · 6

• https://github.com/jenkinsci/active-directory-plugin/commit/549dde617dbcf533e6cabfe8cc148a250a398211 · Nota
• https://jenkins.io/security/advisory/2023-07-12/#SECURITY-3059 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-37943 · Nota de Segurança
• http://openwall.com/lists/oss-security/2023/07/12/2 · Nota
• https://osv.dev/vulnerability/GHSA-g8c3-6fj2-87w7 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-37943 · Aviso do Fabricante