GHSA-2wf5-4mf7-vmh3

CSRF vulnerability in Jenkins Active Directory Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2303

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:active-directory	< 2.20	2.20

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Active Directory Plugin 2.19 and earlier does not require POST requests for multiple HTTP endpoints implementing connection and authentication tests, resulting in cross-site request forgery (CSRF) vulnerabilities. This vulnerability allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified credentials. Active Directory Plugin 2.20 requires POST requests for the affected HTTP endpoints.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2303 advisory
https://github.com/jenkinsci/active-directory-plugin/commit/3558971237b80e71e913ead9e82a722e9d5576b8 web
https://github.com/jenkinsci/active-directory-plugin package
https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2126 web
http://www.openwall.com/lists/oss-security/2020/11/04/6 web