CVE-2019-1003009

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in…

published February 6, 2019

CVSS
—
EPSS
1%
Percentile
55.4
In the wild
Unconfirmed
What it is

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00778 · 55.4th percentile
Published
2019-02-06T16:00Z
EPSS history
Timeline
  • 06 FEB 16:00Z
    An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in…
    cvelistv5