CVE-2023-37943

· MEDIUMModified

← All CVEs

CVSS v3.1

5.9

EPSS

0.46%

Published

Jul 12, 2023

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-311

Affected Products (1)

jenkins · active_directoryvulnerable

References (4)

http://www.openwall.com/lists/oss-security/2023/07/12/2

Mailing ListThird Party Advisory

https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3059

Vendor Advisory

http://www.openwall.com/lists/oss-security/2023/07/12/2

Mailing ListThird Party Advisory

https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3059

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs