Jenkins AD Plugin <=2.30 Ignores TLS Options; Unencrypted AD Test
CVE-2023-37943 Published on July 12, 2023
Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.
Products Associated with CVE-2023-37943
Want to know whenever a new CVE is published for Jenkins Active Directory? stack.watch will email you.
Affected Versions
Jenkins Project Jenkins Active Directory Plugin:- Before and including 2.30 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.