GHSA-2h95-4xw9-m68j
GitHub Security Advisory
Jenkins Active Directory Plugin Improper certificate validation with StartTLS
✓ GitHub Reviewed
HIGH
Has CVE
Advisory Details
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.
Affected Packages
Maven
org.jenkins-ci.plugins:active-directory
Affected versions:
0
(fixed in 2.11)
Related CVEs
Key Information
7.5
/10
Dataset
Last updated: July 1, 2025 6:26 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.