An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and previous versions in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows malicious users to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
jenkins active directory |