medium4.8
CVE-2022-23105
User passwords transmitted in plain text by Jenkins Active Directory Plugin
Impact
Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:active-directory | < 2.25.1 | 2.25.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Active Directory | through 2.25 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2022/01/12/6
- https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-1389
- https://github.com/advisories/GHSA-c8cc-hj57-vm65
- https://nvd.nist.gov/vuln/detail/CVE-2022-23105
- https://github.com/jenkinsci/active-directory-plugin/commit/07b05f83b167c79590f2efbdad8cb84fc98ed150