PT-2020-15530 · Jenkins · Jenkins Active Directory Plugin+1

Lee Jones + 2 · Published 2020-11-04 · Updated 2023-10-25 · CVE-2020-2300

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Active Directory Plugin versions 2.19 and earlier

Description The issue allows attackers to log in to Jenkins as any user by providing an empty password, depending on the configuration of the Active Directory server. This is possible because the Windows/ADSI mode does not specifically prohibit the use of empty passwords. If the Active Directory server allows the unauthenticated bind operation, attackers can exploit this to gain unauthorized access.

Recommendations For Jenkins Active Directory Plugin versions 2.19 and earlier, update to version 2.20 or 2.16.1 to prohibit the use of empty passwords and prevent unauthorized logins.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-2300

GHSA-8WCW-CW2F-H4G2

Affected Products

Jenkins

Jenkins Active Directory Plugin

References · 8

• 🔥 https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2300.json · Exploit
• https://jenkins.io/security/advisory/2020-11-04/#SECURITY-2099 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2300 · Security Note
• https://osv.dev/vulnerability/GHSA-8wcw-cw2f-h4g2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2300 · Vendor Advisory
• https://github.com/jenkinsci/active-directory-plugin/commit/57e78ea7bb96b4e59405f28959ade2d26821163d · Note
• https://github.com/jenkinsci/active-directory-plugin · Note
• http://openwall.com/lists/oss-security/2020/11/04/6 · Note