PT-2018-7157 · Jenkins · Jenkins Active Directory Plugin+1

Steven Christou · Published 2018-07-27 · Updated 2022-05-13 · CVE-2017-2649

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Active Directory Plugin for Jenkins versions up to and including 2.2

Description: The issue allows for Man-in-the-Middle attacks due to the lack of certificate verification of the Active Directory server.

Recommendations: For versions up to and including 2.2, update to a version that verifies certificates of the Active Directory server to prevent Man-in-the-Middle attacks.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2017-2649

GHSA-VCGJ-J8C5-2H52

Affected Products

Jenkins Active Directory Plugin

Jenkins

References · 5

• https://jenkins.io/security/advisory/2017-03-20 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2649 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2649 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vcgj-j8c5-2h52 · Vendor Advisory
• http://securityfocus.com/bid/96986 · Note