PT-2022-15847 · Jenkins · Jenkins Active Directory Plugin+1

Published 2022-01-12 · Updated 2023-11-15 · CVE-2022-23105

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Active Directory Plugin versions 2.25 and earlier

Description The issue concerns the transmission of data between the Jenkins controller and Active Directory servers, which is not encrypted in most configurations.

Recommendations For Jenkins Active Directory Plugin versions 2.25 and earlier, update to a version that encrypts the transmission of data between the Jenkins controller and Active Directory servers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2022-23105

GHSA-C8CC-HJ57-VM65

Affected Products

Jenkins

Jenkins Active Directory Plugin

References · 9

• https://jenkins.io/security/advisory/2022-01-12/#SECURITY-1389 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c8cc-hj57-vm65 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23105 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23105 · Vendor Advisory
• https://github.com/jenkinsci/active-directory-plugin/commit/07b05f83b167c79590f2efbdad8cb84fc98ed150 · Note
• https://github.com/jenkinsci/active-directory-plugin · Note
• https://t.me/cvenotify/25325 · Telegram Post
• http://openwall.com/lists/oss-security/2022/01/12/6 · Note
• https://t.me/cvenotify/25356 · Telegram Post