CVE-2023-37943

Published Jul 12, 2023

Last updated a year ago

CVSS medium 5.9

Overview

Description: Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.
Source: jenkinsci-cert@googlegroups.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.9
Impact score: 3.6
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-311

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:jenkins:active_directory:*:*:*:*:*:jenkins:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FDD3FB1A-224D-4829-A9E0-B2944179F1FD",
            "versionEndIncluding": "2.30"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References