Read the docs
TI-2020-02177 Aliases CVE-2020-2300GHSA-8wcw-cw2f-h4g2

Improper authentication in Jenkins Active Directory Plugin

Priority MEDIUM 45CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user depending on the configuration of the Active Directory server.

Why it matters now

EPSS 0.01672 76th percentileScored 2026-11-07
Fix Fixed Jenkins Active Directory Plugin (Jenkins project): 2.16.1org.jenkins-ci.plugins:active-directory (Maven): 2.20, 2.16.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Active Directory Pluginup to 2.192.16.1Patch availableCNA
—org.jenkins-ci.plugins:active-directory (Maven)2.17 to before 2.202.20Patch availableGHSA-8wcw-cw2f-h4g2
—org.jenkins-ci.plugins:active-directory (Maven)before 2.16.12.16.1Patch availableGHSA-8wcw-cw2f-h4g2
  • Jenkins Active Directory Plugin VendorJenkins Affected up to 2.19 Fixed in 2.16.1 Patch available CNA
  • org.jenkins-ci.plugins:active-directory (Maven) Vendor— Affected 2.17 to before 2.20 Fixed in 2.20 Patch available GHSA-8wcw-cw2f-h4g2
  • org.jenkins-ci.plugins:active-directory (Maven) Vendor— Affected before 2.16.1 Fixed in 2.16.1 Patch available GHSA-8wcw-cw2f-h4g2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:active_directory:*:*:*:*:*:jenkins:*:*up to 2.19VulnerableJenkins
  • cpe:2.3:a:jenkins:active_directory:*:*:*:*:*:jenkins:*:* Versions up to 2.19 Vulnerable ·Jenkins

Remediation

  • Fix · CNA Jenkins Active Directory Plugin (Jenkins project) Fixed in 2.16.1
  • Fix · GHSA-8wcw-cw2f-h4g2 org.jenkins-ci.plugins:active-directory (Maven) Fixed in 2.20 Advisory →
  • Fix · GHSA-8wcw-cw2f-h4g2 org.jenkins-ci.plugins:active-directory (Maven) Fixed in 2.16.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-2300
  2. 2026-10-03 Alias added: GHSA-8wcw-cw2f-h4g2

References

Advisory 3

Other 3

  • TI-2020-02178 Improper authentication in Jenkins Active Directory Plugin CVSS 3.1CRITICAL 9.8
  • TI-2020-02176 Improper authentication in Jenkins Active Directory Plugin CVSS 3.1CRITICAL 9.8
  • TI-2017-01899 Improper certificate validation in Jenkins Active Directory Jenkins plugin CVSS 3.0HIGH 8.1
  • TI-2019-15854 Improper certificate validation in Jenkins Active Directory Plugin CVSS 3.0HIGH 7.4
  • TI-2026-36178 Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation. CVSS 3.1MEDIUM 6.6
  • TI-2026-36177 Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default. CVSS 3.1MEDIUM 6.6
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences