PT-2020-15531 · Jenkins · Jenkins Active Directory Plugin+1

Lee Jones + 2 · Published 2020-11-04 · Updated 2023-10-25 · CVE-2020-2301

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Active Directory Plugin versions 2.19 and earlier Jenkins Active Directory Plugin versions prior to 2.20 and 2.16.1

Description The issue allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode. The plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode. A cache can be configured to remember user lookups and user authentications, which is the source of the problem. In Windows/ADSI mode, the provided password was not used when looking up an applicable cache entry.

Recommendations For Jenkins Active Directory Plugin versions 2.19 and earlier, update to version 2.20 or 2.16.1 to resolve the issue. For Jenkins Active Directory Plugin versions prior to 2.20 and 2.16.1, update to version 2.20 or 2.16.1 to resolve the issue. As a temporary workaround, consider disabling the cache to prevent exploitation. Alternatively, set the Java system property hudson.plugins.active directory.CacheUtil.noCacheAuth to true to no longer cache user authentications.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-2301

GHSA-954F-XW44-56R2

Affected Products

Jenkins

Jenkins Active Directory Plugin

References · 7

• 🔥 https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2301.json · Exploit
• https://jenkins.io/security/advisory/2020-11-04/#SECURITY-2123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2301 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2301 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-954f-xw44-56r2 · Vendor Advisory
• https://github.com/jenkinsci/active-directory-plugin/commit/57e78ea7bb96b4e59405f28959ade2d26821163d · Note
• https://github.com/jenkinsci/active-directory-plugin · Note