Read the docs
TI-2019-15854 Aliases CVE-2019-1003009GHSA-2h95-4xw9-m68j

Improper certificate validation in Jenkins Active Directory Plugin

Priority LOW 34CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.

Why it matters now

EPSS 0.00778 56th percentileScored 2026-11-07
Fix Fixed org.jenkins-ci.plugins:active-directory (Maven): 2.11

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Active Directory Pluginup to 2.10—No fix listedCNA
—org.jenkins-ci.plugins:active-directory (Maven)before 2.112.11Patch availableGHSA-2h95-4xw9-m68j
  • Jenkins Active Directory Plugin VendorJenkins Affected up to 2.10 Fixed in — No fix listed CNA
  • org.jenkins-ci.plugins:active-directory (Maven) Vendor— Affected before 2.11 Fixed in 2.11 Patch available GHSA-2h95-4xw9-m68j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:active_directory:*:*:*:*:*:jenkins:*:*up to 2.10VulnerableJenkins
  • cpe:2.3:a:jenkins:active_directory:*:*:*:*:*:jenkins:*:* Versions up to 2.10 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-2h95-4xw9-m68j org.jenkins-ci.plugins:active-directory (Maven) Fixed in 2.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1003009
  2. 2026-10-03 Alias added: GHSA-2h95-4xw9-m68j

References

Advisory 2

Other 2

  • TI-2020-02178 Improper authentication in Jenkins Active Directory Plugin CVSS 3.1CRITICAL 9.8
  • TI-2020-02177 Improper authentication in Jenkins Active Directory Plugin CVSS 3.1CRITICAL 9.8
  • TI-2020-02176 Improper authentication in Jenkins Active Directory Plugin CVSS 3.1CRITICAL 9.8
  • TI-2017-01899 Improper certificate validation in Jenkins Active Directory Jenkins plugin CVSS 3.0HIGH 8.1
  • TI-2026-36178 Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation. CVSS 3.1MEDIUM 6.6
  • TI-2026-36177 Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default. CVSS 3.1MEDIUM 6.6
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences