Patchfirst
Patchfirst
ChainJenkins Active Directory PluginMaven:org.jenkins-ci.plugins:active-directory

Jenkins Active Directory Plugin: successive fixes (2019–2023)

6 CVEs over 4 generations, 6 Feb 2019 to 12 Jul 2023.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2019-10030096 Feb 2019 First in the chain
  2. CVE-2020-22994 Nov 2020 related to CVE-2019-1003009
  3. CVE-2020-23004 Nov 2020 related to CVE-2019-1003009
  4. CVE-2020-23014 Nov 2020 related to CVE-2019-1003009
  5. CVE-2022-2310512 Jan 2022 related to CVE-2019-1003009related to CVE-2020-2299and 2 more
  6. CVE-2023-3794312 Jul 2023 related to CVE-2022-23105related to CVE-2019-1003009
20192020202120222023 CVE-2019-1003009 → CVE-2020-2299: related (high confidence)CVE-2019-1003009 → CVE-2020-2300: related (high confidence)CVE-2019-1003009 → CVE-2020-2301: related (high confidence)CVE-2022-23105 → CVE-2023-37943: related (high confidence)CVE-2019-1003009 → CVE-2022-23105: related (medium confidence)CVE-2019-1003009 → CVE-2023-37943: related (medium confidence)CVE-2020-2299 → CVE-2022-23105: related (medium confidence)CVE-2020-2300 → CVE-2022-23105: related (medium confidence)CVE-2020-2301 → CVE-2022-23105: related (medium confidence) CVE-2019-1003009 6 Feb 2019 CVE-2020-2299 4 Nov 2020 CVE-2020-2300 4 Nov 2020 CVE-2020-2301 4 Nov 2020 CVE-2022-23105 12 Jan 2022 CVE-2023-37943 12 Jul 2023 20192020202120222023 CVE-2019-1003009 → CVE-2020-2299: related (high confidence)CVE-2019-1003009 → CVE-2020-2300: related (high confidence)CVE-2019-1003009 → CVE-2020-2301: related (high confidence)CVE-2022-23105 → CVE-2023-37943: related (high confidence)CVE-2019-1003009 → CVE-2022-23105: related (medium confidence)CVE-2019-1003009 → CVE-2023-37943: related (medium confidence)CVE-2020-2299 → CVE-2022-23105: related (medium confidence)CVE-2020-2300 → CVE-2022-23105: related (medium confidence)CVE-2020-2301 → CVE-2022-23105: related (medium confidence) CVE-2019-1003009 6 Feb 2019 CVE-2020-2299 4 Nov 2020 CVE-2020-2300 4 Nov 2020 CVE-2020-2301 4 Nov 2020 CVE-2022-23105 12 Jan 2022 CVE-2023-37943 12 Jul 2023
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2019-1003009 6 Feb 2019 An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in… · fixed in 2.11 First in chain 11.2
CVE-2020-2299 4 Nov 2020 Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as… · fixed in 2.20 CVE-2019-1003009 · related · High 14.3
CVE-2020-2300 4 Nov 2020 Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode… · fixed in 2.20 CVE-2019-1003009 · related · High 15.4
CVE-2020-2301 4 Nov 2020 Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a… · fixed in 2.20 CVE-2019-1003009 · related · High 15.4
CVE-2022-23105 12 Jan 2022 Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins… · fixed in 2.25.1 CVE-2019-1003009 · related · Medium 7.8
CVE-2023-37943 12 Jul 2023 Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs… · fixed in 2.30.1 CVE-2022-23105 · related · High 8.0
↑ ↓ chooseEnter openEsc close