PT-2020-15529 · Jenkins · Jenkins Active Directory Plugin+1

Lee Jones + 2 · Published 2020-11-04 · Updated 2023-10-25 · CVE-2020-2299

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Active Directory Plugin versions 1.44 through 2.19 Jenkins Active Directory Plugin versions prior to 2.16.1 and 2.20

Description The issue allows attackers to log in as any user if a magic constant is used as the password. This is due to the shared code between user lookup and user authentication in the LDAP-based mode, where the magic constant is used in place of a real password to distinguish between these behaviors.

Recommendations For Jenkins Active Directory Plugin versions 1.44 through 2.19, update to version 2.20 or later. For Jenkins Active Directory Plugin versions prior to 2.16.1, update to version 2.16.1 or later. As a temporary workaround, consider restricting access to the LDAP-based mode until a patch is available.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-2299

GHSA-RF92-3VJR-W628

Affected Products

Jenkins

Jenkins Active Directory Plugin

References · 8

• 🔥 https://github.com/CVEProject/cvelist/blob/16860a328d970faa6e4350b0fa446f64a52e52ca/2020/2xxx/CVE-2020-2299.json · Exploit
• https://jenkins.io/security/advisory/2020-11-04/#SECURITY-2117 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2299 · Security Note
• https://osv.dev/vulnerability/GHSA-rf92-3vjr-w628 · Vendor Advisory
• https://github.com/jenkinsci/active-directory-plugin/commit/57e78ea7bb96b4e59405f28959ade2d26821163d · Note
• https://github.com/jenkinsci/active-directory-plugin · Note
• http://openwall.com/lists/oss-security/2020/11/04/6 · Note