GHSA-q6rq-4whr-r879

GitHub Security Advisory

Missing permission check in Jenkins Active Directory Plugin allows accessing domain health check page

✓ GitHub Reviewed MODERATE Has CVE

Jenkins Active Directory Plugin 2.19 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to access the domain health check diagnostic page.

Jenkins Active Directory Plugin 2.20 requires Overall/Administer permission to access the domain health check diagnostic page.

Maven org.jenkins-ci.plugins:active-directory

Affected versions: 0 (fixed in 2.20)

CVE-2020-2302

GHSA ID

GHSA-q6rq-4whr-r879

Published

May 24, 2022 5:33 PM

Last Modified

October 27, 2023 1:02 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:active-directory

GitHub Reviewed

✓ Yes

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.