Read the docs

Jenkins

Records1915All Threatist records
Exploited (KEV)7In CISA KEV
CVSS critical79CVSS 9.0–10.0
CVSS high524CVSS 7.0–8.9

Exploited now

Jenkins records in CISA KEV
TI-2017-14573 Jenkins Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2025-10-02TI-2024-15885 Jenkins Command Line Interface (CLI) Path Traversal Vulnerability Priority CRITICAL 100KEV 2024-08-19TI-2023-23979 HTTP/2 Rapid Reset Attack Vulnerability Priority CRITICAL 90KEV 2023-10-10TI-2015-04472 Jenkins User Interface (UI) Information Disclosure Vulnerability Priority CRITICAL 90KEV 2023-05-12TI-2019-15874 Jenkins Script Security Plugin Sandbox Bypass Vulnerability Priority CRITICAL 100KEV 2022-04-25TI-2019-15875 Jenkins Matrix Project Plugin Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Jenkins 294 records CRITICAL Script Security 45 records CRITICAL Pipeline 40 records CRITICAL Active Directory 12 records MEDIUM Blue Ocean 11 records MEDIUM Email Extension 11 records MEDIUM Git 11 records MEDIUM Build Failure Analyzer 9 records MEDIUM

Records

12 records in Active Directory · all components

TI-2020-02178 CVE-2020-2301 · GHSA-954f-xw44-56r2

Improper authentication in Jenkins Active Directory Plugin

Priority MEDIUM 45

Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.017 Published 2020-11-04 Fixed in 2.16.1, 2.20 CWE-287
TI-2020-02177 CVE-2020-2300 · GHSA-8wcw-cw2f-h4g2

Improper authentication in Jenkins Active Directory Plugin

Priority MEDIUM 45

Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user depending on the configuration of the Active D…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01672 Published 2020-11-04 Fixed in 2.16.1, 2.20 CWE-287
TI-2020-02176 CVE-2020-2299 · GHSA-rf92-3vjr-w628

Improper authentication in Jenkins Active Directory Plugin

Priority MEDIUM 45

Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01341 Published 2020-11-04 Fixed in 2.16.1, 2.20 CWE-287
TI-2017-01899 CVE-2017-2649 · GHSA-vcgj-j8c5-2h52

Improper certificate validation in Jenkins Active Directory Jenkins plugin

Priority LOW 37

It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.00947 Published 2018-07-27 Fixed in 2.3 CWE-295
TI-2019-15854 CVE-2019-1003009 · GHSA-2h95-4xw9-m68j

Improper certificate validation in Jenkins Active Directory Plugin

Priority LOW 34

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active…

CVSS 3.0HIGH 7.4 Network No auth No interaction EPSS 0.00778 Published 2019-02-06 Fixed in 2.11 CWE-295
TI-2023-19375 CVE-2023-37943 · GHSA-g8c3-6fj2-87w7

Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls"…

Priority LOW 27

Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to capture network traffi…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00459 Published 2023-07-12 Fixed in 2.30.1 CWE-311
TI-2020-02180 CVE-2020-2303 · GHSA-2wf5-4mf7-vmh3

Cross-site request forgery in Jenkins Active Directory Plugin

Priority LOW 21

A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directo…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00679 Published 2020-11-04 Fixed in 2.16.1, 2.20 CWE-352
TI-2020-02179 CVE-2020-2302 · GHSA-q6rq-4whr-r879

Missing authorization in Jenkins Active Directory Plugin

Priority LOW 21

A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check diagnostic page.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00677 Published 2020-11-04 Fixed in 2.16.1, 2.20 CWE-862
TI-2026-41225 CVE-2026-57288 · GHSA-gx55-p8g7-p3fh

LDAP injection in Jenkins Active Directory Plugin

Priority LOW 18

Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00329 Published 2026-06-24 Fixed in 2.41.2 CWE-90
Open these records in search →